Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
421 results · page 4 of 9
Apr 9, 2024BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg: Stored Cross-Site ScriptingCVE-2024-2845 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 5, 2024InstantCMS is a free and open source content management system.CVE-2024-31213 · Other software · instantsoft · reported by GitHubLow 3.5
InstantCMS is a free and open source content management system. An open redirect was found in the ICMS2 application version 2.16.2 when being redirected after modifying one's own user profile. An attacker could trick a victim into visiting their web application, thinking they are still present on the ICMS2 application. They could then host a website stating "To update your profile, please enter your password," upon which the user may type their password and send it to the attacker. As of time of publication, a patched version is not available.
- Product
- icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2024InstantCMS is a free and open source content management system.CVE-2024-31212 · Other software · instantsoft · reported by GitHubMedium 6.7
InstantCMS is a free and open source content management system. A SQL injection vulnerability affects instantcms v2.16.2 in which an attacker with administrative privileges can cause the application to execute unauthorized SQL code. The vulnerability exists in index_chart_data action, which receives an input from user and passes it unsanitized to the core model `filterFunc` function that further embeds this data in an SQL statement. This allows attackers to inject unwanted SQL code into the statement. The `period` should be escaped before inserting it in the query. As of time of publication, a patched version is not available.
- Product
- icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2024Cross Site Scripting vulnerability in Webasyst v.2.9.9 allows a remote attacker to run arbitrary code via the Instant messenger field in the Contact info functiCVE-2024-29413 · Other software · webasyst · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in Webasyst v.2.9.9 allows a remote attacker to run arbitrary code via the Instant messenger field in the Contact info function.
- Product
- webasyst-framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2024Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels: Unauthorized arbitrary options updateCVE-2024-0869 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels plugin for WordPress is vulnerable to unauthorized arbitrary options update due to an insufficient check that neglects to verify whether the updated option belongs to the plugin on the instant-images/license REST API endpoint in all versions up to, and including, 6.1.0. This makes it possible for authors and higher to update arbitrary options. CVE-2024-33569 appears to be a duplicate of this issue.
- Product
- Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels
- Affected
- up to 6.1.0
- What to do
- Affects up to 6.1.0. Update Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 5, 2024Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24866 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Biteship Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo allows Reflected XSS.This issue affects Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo: from n/a through 2.2.24.
- Product
- Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo
- Affected
- up to 2.2.24
- What to do
- Affects up to 2.2.24. Update Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 29, 2024Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo: Does not sanitise and escape the biteship_error and biteship_message parameters before outputting them back in the pageCVE-2023-6278 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo WordPress plugin before 2.2.25 does not sanitise and escape the biteship_error and biteship_message parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo
- Fixed in
- 2.2.25
- What to do
- Update Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo to 2.2.25 or newer.
Dec 31, 2023Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-51423 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition.This issue affects Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: from n/a through 3.05.0.
- Product
- Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition
- Affected
- up to 3.05.0
- What to do
- Affects up to 3.05.0. Update Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 29, 2023Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: Deserialization of Untrusted DataCVE-2023-51422 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Deserialization of Untrusted Data vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition.This issue affects Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: from n/a through 3.05.0.
- Product
- Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition
- Affected
- up to 3.05.0
- What to do
- Affects up to 3.05.0. Update Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 27, 2023A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed.CVE-2023-3171 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service.
- Product
- EAP 7.4.13
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Dec 15, 2023Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49767 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Biteship Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo allows Stored XSS.This issue affects Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo: from n/a through 2.2.24.
- Product
- Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo
- Affected
- up to 2.2.24
- What to do
- Affects up to 2.2.24. Update Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 4, 2023Improper URL validation from InstantPlay deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute JavaScript API to access data.CVE-2023-42581 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.5
Improper URL validation from InstantPlay deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute JavaScript API to access data.
- Product
- Galaxy Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Nov 22, 2023Server-Side Request Forgery (SSRF) vulnerability in Darren Cooney Instant Images plugin <= 5.1.0.2 versions.CVE-2023-27451 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Server-Side Request Forgery (SSRF) vulnerability in Darren Cooney Instant Images plugin <= 5.1.0.2 versions.
- Affected
- up to 5.1.0.2
- What to do
- Affects up to 5.1.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in Dylan Blokhuis Instant CSS plugin <= 1.2.1 versions.CVE-2023-44243 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Dylan Blokhuis Instant CSS plugin <= 1.2.1 versions.
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Sep 12, 2023 SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1.CVE-2023-4928 · Other software · instantsoft · reported by security@huntr.devHigh 7.2
SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2023Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1.-git.CVE-2023-4879 · Other software · instantsoft · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1.-git.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2023Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-4878 · Other software · instantsoft · reported by security@huntr.devMedium 5.4
Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2023External Control of System or Configuration Setting in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-4704 · Other software · instantsoft · reported by security@huntr.devMedium 4.9
External Control of System or Configuration Setting in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1.CVE-2023-4655 · Other software · instantsoft · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1.CVE-2023-4654 · Other software · instantsoft · reported by security@huntr.devLow 3.5
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-4653 · Other software · instantsoft · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-4652 · Other software · instantsoft · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1.CVE-2023-4651 · Other software · instantsoft · reported by security@huntr.devMedium 5.4
Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Improper Access Control in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-4650 · Other software · instantsoft · reported by security@huntr.devMedium 4.7
Improper Access Control in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Session Fixation in GitHub repository instantsoft/icms2 prior to 2.16.1.CVE-2023-4649 · Other software · instantsoft · reported by security@huntr.devMedium 5.4
Session Fixation in GitHub repository instantsoft/icms2 prior to 2.16.1.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2023TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object InstantiaCVE-2022-24989 · Other software · terra-master · reported by MITRECritical 9.8
TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because popen is used without any sanitization.) The credentials from CVE-2022-24990 exploitation can be used.
- Product
- terramaster_operating_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordattackerkb.comforum.terra-master.com
Aug 16, 2023Unverified Password Change in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-4381 · Other software · instantsoft · reported by security@huntr.devMedium 4.3
Unverified Password Change in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-4189 · Other software · instantsoft · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2023 SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-4188 · Other software · instantsoft · reported by security@huntr.devCritical 9.1
SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2023Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-4187 · Other software · instantsoft · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2023There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted CVE-2023-35982 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- Aruba Access Points running InstantOS and ArubaOS 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Jul 25, 2023There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted CVE-2023-35981 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- Aruba Access Points running InstantOS and ArubaOS 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Jul 25, 2023There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted CVE-2023-35980 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- Aruba Access Points running InstantOS and ArubaOS 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Jun 16, 2023L7 Networks InstantScan IS-8000 & InstantQoS IQ-8000’s file uploading function does not restrict upload of file with dangerous type.CVE-2023-32752 · Other software · L7 Networks · reported by twcert@cert.org.twCritical 9.8
L7 Networks InstantScan IS-8000 & InstantQoS IQ-8000’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service.
- Product
- InstantScan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
May 26, 2023XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store.CVE-2023-21516 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.5
XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store.
- Product
- Galaxy Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
May 26, 2023InstantPlay which included vulnerable script which could execute javascript in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript APICVE-2023-21515 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.5
InstantPlay which included vulnerable script which could execute javascript in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store.
- Product
- Galaxy Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
May 26, 2023Improper scheme validation from InstantPlay Deeplink in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from GaCVE-2023-21514 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.5
Improper scheme validation from InstantPlay Deeplink in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store.
- Product
- Galaxy Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
May 8, 2023A vulnerability exists in Aruba InstantOS and ArubaOS 10 where an edge-case combination of network configuration, a specific WLAN environment and an attacker alCVE-2023-22791 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 5.4
A vulnerability exists in Aruba InstantOS and ArubaOS 10 where an edge-case combination of network configuration, a specific WLAN environment and an attacker already possessing valid user credentials on that WLAN can lead to sensitive information being disclosed via the WLAN. The scenarios in which this disclosure of potentially sensitive information can occur are complex and depend on factors that are beyond the control of the attacker.
- Product
- Aruba Access Points running InstantOS and ArubaOS 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
May 8, 2023Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface.CVE-2023-22790 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
- Product
- Aruba Access Points running InstantOS and ArubaOS 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
May 8, 2023Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface.CVE-2023-22789 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
- Product
- Aruba Access Points running InstantOS and ArubaOS 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
May 8, 2023Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface.CVE-2023-22788 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
- Product
- Aruba Access Points running InstantOS and ArubaOS 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
May 8, 2023An unauthenticated Denial of Service (DoS) vulnerability exists in a service accessed via the PAPI protocol provided by Aruba InstantOS and ArubaOS 10.CVE-2023-22787 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.5
An unauthenticated Denial of Service (DoS) vulnerability exists in a service accessed via the PAPI protocol provided by Aruba InstantOS and ArubaOS 10. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected access point.
- Product
- Aruba Access Points running InstantOS and ArubaOS 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
May 8, 2023There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted CVE-2023-22786 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- Aruba Access Points running InstantOS and ArubaOS 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
May 8, 2023There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted CVE-2023-22785 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- Aruba Access Points running InstantOS and ArubaOS 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
May 8, 2023There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted CVE-2023-22784 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- Aruba Access Points running InstantOS and ArubaOS 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
May 8, 2023There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted CVE-2023-22783 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- Aruba Access Points running InstantOS and ArubaOS 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
May 8, 2023There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted CVE-2023-22782 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- Aruba Access Points running InstantOS and ArubaOS 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
May 8, 2023There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted CVE-2023-22781 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- Aruba Access Points running InstantOS and ArubaOS 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
May 8, 2023There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted CVE-2023-22780 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- Aruba Access Points running InstantOS and ArubaOS 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
May 8, 2023There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted CVE-2023-22779 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- Aruba Access Points running InstantOS and ArubaOS 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.