Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

304 results · page 4 of 7

Aug 1, 2023TP-Link Archer AX21(US)_V3_1.1.4 Build 20230219 and AX21(US)_V3.6_1.1.4 Build 20230219 are vulnerable to Buffer Overflow.CVE-2023-31710 · Network & remote access · tp-link · reported by MITRECritical 9.8
TP-Link Archer AX21(US)_V3_1.1.4 Build 20230219 and AX21(US)_V3.6_1.1.4 Build 20230219 are vulnerable to Buffer Overflow.
Product
archer_ax21
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 18, 2023TP-LINK Archer C50v2 Archer C50(US)_V2_160801, TP-LINK Archer C20v1 Archer_C20_V1_150707, and TP-LINK Archer C2v1 Archer_C2_US__V1_170228 were discovered to conCVE-2023-30383 · Network & remote access · tp-link · reported by MITREHigh 7.5
TP-LINK Archer C50v2 Archer C50(US)_V2_160801, TP-LINK Archer C20v1 Archer_C20_V1_150707, and TP-LINK Archer C2v1 Archer_C2_US__V1_170228 were discovered to contain a buffer overflow which may lead to a Denial of Service (DoS) when parsing crafted data.
Product
archer_c50
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com tp-link.com
Jul 14, 2023An issue in Archer Platform before v.6.13 fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to obtain sensitive information via the log files.CVE-2023-37224 · Other software · Archerirm · reported by MITREMedium 6
An issue in Archer Platform before v.6.13 fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to obtain sensitive information via the log files.
Product
Archer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archerirm.com archerirm.community
Jul 14, 2023Cross Site Scripting (XSS) vulnerability in Archer Platform before v.6.13 and fixed in v.6.12.0.6 and v.6.13.0 allows a remote authenticated attacker to executeCVE-2023-37223 · Other software · Archerirm · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in Archer Platform before v.6.13 and fixed in v.6.12.0.6 and v.6.13.0 allows a remote authenticated attacker to execute arbitrary code via a crafted malicious script.
Product
Archer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archerirm.com archerirm.community
Jul 14, 2023Cross Site Request Forgery (CSRF) vulnerability in Archer Platform before v.6.13 and fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to executCVE-2023-32761 · Other software · Archerirm · reported by MITREHigh 8.1
Cross Site Request Forgery (CSRF) vulnerability in Archer Platform before v.6.13 and fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to execute arbitrary code via a crafted request.
Product
Archer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archerirm.community archerirm.community
Jul 14, 2023An issue in Archer Platform before v.6.13 fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to obtain sensitive information via API calls relateCVE-2023-32760 · Other software · Archerirm · reported by MITREHigh 7.7
An issue in Archer Platform before v.6.13 fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to obtain sensitive information via API calls related to data feeds and data publication.
Product
Archer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archerirm.community archerirm.community
Jul 14, 2023An issue in Archer Platform before v.6.13 and fixed in 6.12.0.6 and 6.13.0 allows an authenticated attacker to obtain sensitive information via a crafted URL.CVE-2023-32759 · Other software · Archerirm · reported by MITREHigh 7.5
An issue in Archer Platform before v.6.13 and fixed in 6.12.0.6 and 6.13.0 allows an authenticated attacker to obtain sensitive information via a crafted URL.
Product
Archer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archerirm.community archerirm.community
Jun 16, 2023TP-Link Archer AX10(EU)_V1.2_230220 was discovered to contain a buffer overflow via the function FUN_131e8 - 0x132B4.CVE-2023-34832 · Network & remote access · Tp-link · reported by MITRECritical 9.8
TP-Link Archer AX10(EU)_V1.2_230220 was discovered to contain a buffer overflow via the function FUN_131e8 - 0x132B4.
Product
Archer Ax10 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com gist.github.com
May 19, 2023A command injection vulnerability exists in the administrative web portal in TP-Link Archer VR1600V devices running firmware Versions <= 0.1.0.CVE-2023-31756 · Network & remote access · Tp-link · reported by MITREMedium 6.7
A command injection vulnerability exists in the administrative web portal in TP-Link Archer VR1600V devices running firmware Versions <= 0.1.0. 0.9.1 v5006.0 Build 220518 Rel.32480n which allows remote attackers, authenticated to the administrative web portal as an administrator user to open an operating system level shell via the 'X_TP_IfName' parameter.
Product
Archer Vr1600v Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record stanleyjobsonau.github.io stanleyjobsonau.github.io
May 11, 2023A vulnerability has been found in TP-Link Archer C7v2 v2_en_us_180114 and classified as problematic.CVE-2023-2646 · Network & remote access · TP-Link · reported by VulDBMedium 4.5
A vulnerability has been found in TP-Link Archer C7v2 v2_en_us_180114 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component GET Request Parameter Handler. The manipulation leads to denial of service. The attack can only be done within the local network. The associated identifier of this vulnerability is VDB-228775. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Product
Archer C7v2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuldb.com vuldb.com
May 1, 2023Archer Platform 6.8 before 6.12 P6 HF1 (6.12.0.6.1) contains a stored XSS vulnerability.CVE-2023-30639 · Other software · Archerirm · reported by MITREHigh 7.1
Archer Platform 6.8 before 6.12 P6 HF1 (6.12.0.6.1) contains a stored XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. 6.11.P4 (6.11.0.4) is also a fixed release.
Product
Archer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archerirm.community archerirm.community
Apr 18, 2023Archery is an open source SQL audit platform.CVE-2023-30605 · Other software · hhyo · reported by GitHubMedium 6.5
Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. User input coming from the `variable_name` and `variable_value` parameter value in the `sql/instance.py` `param_edit` endpoint is passed to a set of methods in given SQL engine implementations, which concatenate user input unsafely into a SQL query and afterwards pass it to the `query` method of each database engine for execution. The affected methods are: `set_variable` in `sql/engines/goinception.py` which concatenates input which is passed to execution on the database in the `sql/engines/goinception.py`, `get_variables` in `sql/engines/goinception.py` which concatenates input which is passed to execution on the database in the `sql/engines/goinception.py`, `set_variable` in `sql/engines/mysql.py` which concatenates input which is passed to execution on the database in the `sql/engines/mysql.py` `query`, and `get_variables` in `sql/engines/mysql.py`which concatenates input which is passed to execution on the database in the `sql/engines/mysql.py` `query`. Each of these issues may be mitigated by escaping
Product
Archery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 18, 2023Archery is an open source SQL audit platform.CVE-2023-30558 · Other software · hhyo · reported by GitHubMedium 6.5
Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. User input coming from the `db_name` in the `sql/data_dictionary.py` `table_list` endpoint is passed to the methods that follow in a given SQL engine implementations, which concatenate user input unsafely into a SQL query and afterwards pass it to the `query` method of each database engine for execution. The affected methods are `get_group_tables_by_db` in `sql/engines/mssql.py`which passes unsafe user input to `sql/engines/mssql.py`, and `get_group_tables_by_db` in `sql/engines/oracle.py`which concatenates input which is passed to execution on the database in the `sql/engines/oracle.py` `query` method. Each of these issues may be mitigated by escaping user input or by using prepared statements when executing SQL queries. This issue is also indexed as `GHSL-2022-105`.
Product
Archery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 18, 2023Archery is an open source SQL audit platform.CVE-2023-30557 · Other software · hhyo · reported by GitHubMedium 6.5
Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to SQL injection in the `data_dictionary.py` `table_info`. User input coming from the `db_name` in and the `tb_name` parameter values in the `sql/data_dictionary.py` `table_info` endpoint is passed to the following methods in the given SQL engine implementations, which concatenate user input unsafely into a SQL query and afterwards pass it to the `query` method of each database engine for execution.The methods are `get_table_meta_data ` in `sql/engines/mssql.py` which passes unsafe user input to the `sql/engines/mssql.py` `query` method, `get_table_desc_data` in `sql/engines/mssql.py`which passes unsafe user input to the `sql/engines/mssql.py` `query`, `get_table_index_data` in `sql/engines/mssql.py`which passes unsafe user input to the `sql/engines/mssql.py` `query` method, `get_table_meta_data` in `sql/engines/oracle.py`which concatenates input which is passed to execution on the database in the `sql/engines/oracle.py` `query` method, `get_table_desc_data` in `sql/engines/oracl
Product
Archery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 18, 2023Archery is an open source SQL audit platform.CVE-2023-30556 · Other software · hhyo · reported by GitHubMedium 6.5
Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to SQL injection in the `optimize_sqltuningadvisor` method of `sql_optimize.py`. User input coming from the `db_name` parameter value in `sql_optimize.py` is passed to the `sqltuningadvisor` method in `oracle.py`for execution. To mitigate escape the variables accepted via user input when used in `sql_optimize.py`. Users may also use prepared statements when dealing with SQL as a mitigation for this issue. This issue is also indexed as `GHSL-2022-107`.
Product
Archery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 18, 2023Archery is an open source SQL audit platform.CVE-2023-30555 · Other software · hhyo · reported by GitHubMedium 6.5
Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases.Affected versions are subject to SQL injection in the `explain` method in `sql_optimize.py`. User input coming from the `db_name` parameter value in the `explain` endpoint is passed to the following `query` methods of each database engine for execution. `query` in `sql/engines/mssql.py`, and `query` in `sql/engines/oracle.py`. Each of these issues may be mitigated by escaping user input or by using prepared statements when executing SQL queries. This issue is also indexed as `GHSL-2022-108`.
Product
Archery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 18, 2023Archery is an open source SQL audit platform.CVE-2023-30554 · Other software · hhyo · reported by GitHubMedium 6.5
Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to SQL injection in the `sql_api/api_workflow.py` endpoint `ExecuteCheck` which passes unfiltered input to the `explain_check` method in `sql/engines/oracle.py`. User input coming from the `db_name` parameter value in the `api_workflow.py` `ExecuteCheck` endpoint is passed through the `oracle.py` `execute_check` method and to the `explain_check` method for execution. Each of these issues may be mitigated by escaping user input or by using prepared statements when executing SQL queries. This issue is also indexed as `GHSL-2022-103`.
Product
Archery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 18, 2023Archery is an open source SQL audit platform.CVE-2023-30553 · Other software · hhyo · reported by GitHubMedium 6.5
Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to multiple SQL injections in the `sql_api/api_workflow.py` endpoint `ExecuteCheck`. User input coming from the `db_name` parameter value and the `full_sql` parameter value in the `api_workflow.py` `ExecuteCheck` endpoint is passed to the methods that follow in given SQL engine implementations, which concatenate user input unsafely into a SQL query and afterwards pass it to the `query` method of each database engine for execution. The affected methods are `execute_check` in `sql/engines/clickhouse.py` which concatenates input which is passed to execution on the database in the `sql/engines/clickhouse.py` `query` method, `execute_check` in `sql/engines/goinception.py`which concatenates input which is passed to execution on the database in the `sql/engines/goinception.py` `query` method, `execute_check` in `sql/engines/oracle.py`which passes unsafe user input into the `object_name_check` method in `sql/engines/oracle.py` which in turn is passed to execution on the database in the `
Product
Archery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 18, 2023Archery is an open source SQL audit platform.CVE-2023-30552 · Other software · hhyo · reported by GitHubMedium 6.5
Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to SQL injection in the `sql/instance.py` endpoint's `describe` method. In several cases, user input coming from the `tb_name` parameter value, the `db_name` parameter value or the `schema_name` value in the `sql/instance.py` `describe` endpoint is passed to the `describe_table` methods in given SQL engine implementations, which concatenate user input unsafely into a SQL query and afterwards pass it to the `query` method of each database engine for execution. Please take into account that in some cases all three parameter values are concatenated, in other only one or two of them. The affected methods are: `describe_table` in `sql/engines/clickhouse.py`which concatenates input which is passed to execution on the database in the `query` method in `sql/engines/clickhouse.py`, `describe_table` in `sql/engines/mssql.py` which concatenates input which is passed to execution on the database in the `query` methods in `sql/engines/mssql.py`, `describe_table` in `sql/engines/mysql.py`whi
Product
Archery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 15, 2023TP-Link Archer AX-21 Command Injection VulnerabilityCVE-2023-1389 · Network & remote access · TP-Link · reported by vulnreport@tenable.comExploitedHigh 8.8
TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution.
Product
Archer AX21
On CISA’s list since
May 1, 2023 (federal fix deadline May 22, 2023)
What to do
Attackers are using this now. Install TP-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com tenable.com
Feb 21, 2023A vulnerability was found in TP-Link Archer C50 V2_160801.CVE-2023-0936 · Network & remote access · TP-Link · reported by VulDBMedium 6.5
A vulnerability was found in TP-Link Archer C50 V2_160801. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Web Management Interface. The manipulation leads to denial of service. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221552.
Product
Archer C50
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuldb.com vuldb.com
Jan 11, 2023In TP-Link routers, Archer C5 and WR710N-V1, running the latest available code, when receiving HTTP Basic Authentication the httpd service can be sent a craftedCVE-2022-4498 · Network & remote access · TP-Link · reported by cret@cert.orgCritical 9.8
In TP-Link routers, Archer C5 and WR710N-V1, running the latest available code, when receiving HTTP Basic Authentication the httpd service can be sent a crafted packet that causes a heap overflow. This can result in either a DoS (by crashing the httpd process) or an arbitrary code execution.
Product
WR710N
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
Jan 11, 2023TP-Link routers, Archer C5 and WR710N-V1, using the latest software, the strcmp function used for checking credentials in httpd, is susceptible to a side-channeCVE-2022-4499 · Network & remote access · TP-Link · reported by cret@cert.orgHigh 7.5
TP-Link routers, Archer C5 and WR710N-V1, using the latest software, the strcmp function used for checking credentials in httpd, is susceptible to a side-channel attack. By measuring the response time of the httpd process, an attacker could guess each byte of the username and password.
Product
WR710N
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
Dec 16, 2022 Rockwell Automation was made aware of a vulnerability by a security researcher from Georgia Institute of Technology that the MicroLogix 1100 and 1400 controlleCVE-2022-46670 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 7.1
Rockwell Automation was made aware of a vulnerability by a security researcher from Georgia Institute of Technology that the MicroLogix 1100 and 1400 controllers contain a vulnerability that may give an attacker the ability to accomplish remote code execution. The vulnerability is an unauthenticated stored cross-site scripting vulnerability in the embedded webserver. The payload is transferred to the controller over SNMP and is rendered on the homepage of the embedded website.
Product
MicroLogix 1100 & 1400 Controllers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rockwellautomation.custhelp.com rockwellautomation.custhelp.com
Sep 28, 2022TP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel.CVE-2022-40486 · Network & remote access · Tp-link · reported by MITREHigh 8.8
TP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel. 57450(5553) was discovered to allow authenticated attackers to execute arbitrary code via a crafted backup file.
Product
Archer Ax10 V1 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com tp-link.com
Sep 13, 2022Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the kill_session interface.CVE-2022-38542 · Other software · Archerydms · reported by MITRECritical 9.8
Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the kill_session interface. The project has released an update, please upgrade to v1.9.0 and above.
Product
Archery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record announcements.bybit.com github.com
Sep 13, 2022Archery v1.8.3 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_time and stop_time parameters in the my2sql interface.CVE-2022-38541 · Other software · Archerydms · reported by MITRECritical 9.8
Archery v1.8.3 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_time and stop_time parameters in the my2sql interface.
Product
Archery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record announcements.bybit.com github.com
Sep 13, 2022Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the create_kill_session interface.CVE-2022-38540 · Other software · Archerydms · reported by MITRECritical 9.8
Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the create_kill_session interface.
Product
Archery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record announcements.bybit.com github.com
Sep 13, 2022Archery v1.7.5 to v1.8.5 was discovered to contain a SQL injection vulnerability via the where parameter at /archive/apply.CVE-2022-38539 · Other software · Archerydms · reported by MITRECritical 9.8
Archery v1.7.5 to v1.8.5 was discovered to contain a SQL injection vulnerability via the where parameter at /archive/apply.
Product
Archery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record announcements.bybit.com github.com
Sep 13, 2022Archery v1.7.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the checksum parameter in the report module.CVE-2022-38538 · Other software · Archerydms · reported by MITRECritical 9.8
Archery v1.7.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the checksum parameter in the report module.
Product
Archery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record announcements.bybit.com github.com
Sep 13, 2022Archery v1.4.5 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_file, end_file, start_time, and stop_time parameters in CVE-2022-38537 · Other software · Archerydms · reported by MITRECritical 9.8
Archery v1.4.5 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_file, end_file, start_time, and stop_time parameters in the binlog2sql interface.
Product
Archery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record announcements.bybit.com github.com
Aug 25, 2022Archer Platform 6.9 SP2 P2 before 6.11 P3 (6.11.0.3) contain a reflected XSS vulnerability.CVE-2022-37318 · Other software · RSA · reported by MITREHigh 7
Archer Platform 6.9 SP2 P2 before 6.11 P3 (6.11.0.3) contain a reflected XSS vulnerability. A remote unauthenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious JavaScript code to the vulnerable web application. This code is then reflected to the victim and gets executed by the web browser in the context of the vulnerable web application. 6.10 P4 (6.10.0.4) and 6.11 P2 HF4 (6.11.0.2.4) are also fixed releases.
Product
Archer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archerirm.com archerirm.community
Aug 25, 2022Archer Platform 6.x before 6.11 P3 contain an HTML injection vulnerability.CVE-2022-37317 · Other software · RSA · reported by MITREHigh 7.6
Archer Platform 6.x before 6.11 P3 contain an HTML injection vulnerability. An authenticated remote attacker could potentially exploit this vulnerability by tricking a victim application user to execute malicious code in the context of the web application. 6.10 P4 (6.10.0.4) and 6.11 P2 HF4 (6.11.0.2.4) are also fixed releases.
Product
Archer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archerirm.com archerirm.community
Aug 25, 2022Archer Platform 6.8 before 6.11 P3 (6.11.0.3) contains an improper API access control vulnerability in a multi-instance system that could potentially present unCVE-2022-37316 · Other software · RSA · reported by MITREMedium 6.5
Archer Platform 6.8 before 6.11 P3 (6.11.0.3) contains an improper API access control vulnerability in a multi-instance system that could potentially present unauthorized metadata to an authenticated user of the affected system. 6.10 P3 HF1 (6.10.0.3.1) is also a fixed release.
Product
Archer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archerirm.com archerirm.community
Aug 22, 2022TP-Link Archer A7 Archer A7(US)_V5_210519 is affected by a command injection vulnerability in /usr/bin/tddp.CVE-2021-42232 · Network & remote access · Tp-link · reported by MITRECritical 9.8
TP-Link Archer A7 Archer A7(US)_V5_210519 is affected by a command injection vulnerability in /usr/bin/tddp. The vulnerability is caused by the program taking part of the received data packet as part of the command. This will cause an attacker to execute arbitrary commands on the router.
Product
Archer A7 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 30, 2022A stack overflow in the function DM_ In fillobjbystr() of TP-Link Archer C50&A5(US)_V5_200407 allows attackers to cause a Denial of Service (DoS) via a crafted CVE-2022-33087 · Network & remote access · Tp-link · reported by MITREHigh 7.5
A stack overflow in the function DM_ In fillobjbystr() of TP-Link Archer C50&A5(US)_V5_200407 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
Product
Archer A5 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 9, 2022In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validatiCVE-2022-30075 · Network & remote access · Tp-link · reported by MITREHigh 8.8
In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validation.
Product
Archer Ax50 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jun 2, 2022RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type.CVE-2021-33615 · Other software · RSA · reported by MITREHigh 7.5
RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type.
Product
Archer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.rsa.com github.com
May 26, 2022The REST API in Archer Platform 6.x before 6.11 (6.11.0.0) contains an Authorization Bypass Vulnerability.CVE-2022-30585 · Other software · RSA · reported by MITREMedium 6.5
The REST API in Archer Platform 6.x before 6.11 (6.11.0.0) contains an Authorization Bypass Vulnerability. A remote authenticated malicious user could potentially exploit this vulnerability to view sensitive information. 6.10 P3 (6.10.0.3) and 6.9 SP3 P4 (6.9.3.4) are also fixed releases.
Product
Archer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archerirm.community archerirm.community
May 26, 2022Archer Platform 6.3 before 6.11 (6.11.0.0) contains an Improper Access Control Vulnerability within SSO ADFS functionality that could potentially be exploited bCVE-2022-30584 · Other software · RSA · reported by MITRECritical 9.6
Archer Platform 6.3 before 6.11 (6.11.0.0) contains an Improper Access Control Vulnerability within SSO ADFS functionality that could potentially be exploited by malicious users to compromise the affected system. 6.10 P3 (6.10.0.3) and 6.9 SP3 P4 (6.9.3.4) are also fixed releases.
Product
Archer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archerirm.community archerirm.community
Apr 25, 2022A researcher reported a Directory Transversal Vulnerability in Serv-U 15.3.CVE-2021-35250 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7.5
A researcher reported a Directory Transversal Vulnerability in Serv-U 15.3. This may allow access to files relating to the Serv-U installation and server files. This issue has been resolved in Serv-U 15.3 Hotfix 1.
Product
Serv-U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.solarwinds.com solarwinds.com
Apr 4, 2022An Unquoted Service Path vulnerability exists in AnyTXT Searcher 1.2.394 via a specially crafted file in the ATService path.CVE-2021-43454 · Other software · Anytxt · reported by MITREHigh 7.8
An Unquoted Service Path vulnerability exists in AnyTXT Searcher 1.2.394 via a specially crafted file in the ATService path. .
Product
Anytxt Searcher
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com github.com
Apr 4, 2022RSA Archer 6.x through 6.9 SP1 P4 (6.9.1.4) allows stored XSS.CVE-2021-33616 · Other software · RSA · reported by MITREMedium 5.4
RSA Archer 6.x through 6.9 SP1 P4 (6.9.1.4) allows stored XSS.
Product
Archer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.rsa.com github.com
Mar 30, 2022In RSA Archer 6.x through 6.9 SP3 (6.9.3.0), an authenticated attacker can make a GET request to a REST API endpoint that is vulnerable to an Insecure Direct ObCVE-2021-38362 · Other software · RSA · reported by MITREMedium 6.5
In RSA Archer 6.x through 6.9 SP3 (6.9.3.0), an authenticated attacker can make a GET request to a REST API endpoint that is vulnerable to an Insecure Direct Object Reference (IDOR) issue and retrieve sensitive data.
Product
Archer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 29, 2022Archer 6.x through 6.10 (6.10.0.0) contains a reflected XSS vulnerability.CVE-2022-26951 · Other software · RSA · reported by MITREMedium 6.5
Archer 6.x through 6.10 (6.10.0.0) contains a reflected XSS vulnerability. A remote SAML-unauthenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the malicious code is then reflected back to the victim and gets executed by the web browser in the context of the vulnerable web application.
Product
Archer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archerirm.community archerirm.community
Mar 29, 2022Archer 6.x through 6.9 P2 (6.9.0.2) is affected by an open redirect vulnerability.CVE-2022-26950 · Other software · RSA · reported by MITREMedium 5.4
Archer 6.x through 6.9 P2 (6.9.0.2) is affected by an open redirect vulnerability. A remote unprivileged attacker may potentially redirect legitimate users to arbitrary web sites and conduct phishing attacks. The attacker could then steal the victims' credentials and silently authenticate them to the Archer application without the victims realizing an attack occurred.
Product
Archer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archerirm.community archerirm.community
Mar 29, 2022Archer 6.x through 6.9 SP2 P1 (6.9.2.1) contains an improper access control vulnerability on attachments.CVE-2022-26949 · Other software · RSA · reported by MITREMedium 5.3
Archer 6.x through 6.9 SP2 P1 (6.9.2.1) contains an improper access control vulnerability on attachments. A remote authenticated malicious user could potentially exploit this vulnerability to gain access to files that should only be allowed by extra privileges.
Product
Archer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archerirm.community archerirm.community
Mar 29, 2022The Archer RSS feed integration for Archer 6.x through 6.9 SP1 (6.9.1.0) is affected by an insecure credential storage vulnerability.CVE-2022-26948 · Other software · RSA · reported by MITREMedium 5.8
The Archer RSS feed integration for Archer 6.x through 6.9 SP1 (6.9.1.0) is affected by an insecure credential storage vulnerability. A malicious attacker may obtain access to credential information to use it in further attacks.
Product
Archer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archerirm.community archerirm.community
Mar 29, 2022Archer 6.x through 6.9 SP3 (6.9.3.0) contains a reflected XSS vulnerability.CVE-2022-26947 · Other software · RSA · reported by MITREMedium 6.3
Archer 6.x through 6.9 SP3 (6.9.3.0) contains a reflected XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the malicious code is then reflected back to the victim and gets executed by the web browser in the context of the vulnerable web application.
Product
Archer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archerirm.community archerirm.community
Mar 29, 2022In RSA Archer 6.9.SP1 P3, if some application functions are precluded by the Administrator, this can be bypassed by intercepting the API request at the /api/V2/CVE-2021-41594 · Other software · RSA · reported by MITREMedium 6.5
In RSA Archer 6.9.SP1 P3, if some application functions are precluded by the Administrator, this can be bypassed by intercepting the API request at the /api/V2/internal/TaskPermissions/CheckTaskAccess endpoint. If the parameters of this request are replaced with empty fields, the attacker achieves access to the precluded functions.
Product
Archer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archerirm.community rsa.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.