Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
241 results · page 4 of 5
Jun 13, 2024A Reflected Cross-Site Scripting (XSS) vulnerability in the blog function of Modern Campus - Omni CMS 2023.1 allows a remote attacker to inject arbitrary scriptCVE-2023-35859 · Other software · Moderncampus · reported by MITREMedium 6.1
A Reflected Cross-Site Scripting (XSS) vulnerability in the blog function of Modern Campus - Omni CMS 2023.1 allows a remote attacker to inject arbitrary scripts or HTML via multiple parameters.
- Product
- Omni CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlp.constantcontactpages.comlp.constantcontactpages.com
Jun 13, 2024XPath Injection vulnerabilities in the blog and RSS functions of Modern Campus - Omni CMS 2023.1 allow a remote, unauthenticated attacker to obtain application CVE-2023-35858 · Other software · moderncampus · reported by MITREMedium 5.3
XPath Injection vulnerabilities in the blog and RSS functions of Modern Campus - Omni CMS 2023.1 allow a remote, unauthenticated attacker to obtain application information.
- Product
- omni_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlp.constantcontactpages.comlp.constantcontactpages.com
Apr 24, 2024Telemetry Dashboard v1.0.0.7 for Dell ThinOS 2402 contains a sensitive information disclosure vulnerability.CVE-2024-28963 · Other software · Dell · reported by security_alert@emc.comMedium 6.2
Telemetry Dashboard v1.0.0.7 for Dell ThinOS 2402 contains a sensitive information disclosure vulnerability. An unauthenticated user with local access to the device could exploit this vulnerability to read sensitive proxy settings information.
- Product
- Wyse Proprietary OS (Modern ThinOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2024Rustls is a modern TLS library written in Rust.CVE-2024-32650 · Other software · rustls · reported by GitHubHigh 7.5
Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.
- Product
- rustls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2024A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting speculative execution (related to Spectre V1) has been disclosCVE-2024-2193 · Other software · AMD · reported by cret@cert.orgMedium 5.7
A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting speculative execution (related to Spectre V1) has been disclosed. An unauthenticated attacker can exploit this vulnerability to disclose arbitrary data from the CPU using race conditions to access the speculative executable code paths.
- Product
- CPU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comdownload.vusec.net
Feb 13, 2024Zimbra Collaboration before Kepler 9.0.0 Patch 38 GA allows DOM-based JavaScript injection in the Modern UI.CVE-2023-50808 · Email & office · synacor · reported by MITREMedium 6.1
Zimbra Collaboration before Kepler 9.0.0 Patch 38 GA allows DOM-based JavaScript injection in the Modern UI.
- Product
- zimbra_collaboration_suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comwiki.zimbra.com
Feb 8, 2024Micronaut Framework is a modern, JVM-based, full stack Java framework designed for building modular, easily testable JVM applications with support for Java, KotCVE-2024-23639 · Other software · micronaut-projects · reported by GitHubMedium 5.1
Micronaut Framework is a modern, JVM-based, full stack Java framework designed for building modular, easily testable JVM applications with support for Java, Kotlin and the Groovy language. Enabled but unsecured management endpoints are susceptible to drive-by localhost attacks. While not typical of a production application, these attacks may have more impact on a development environment where such endpoints may be flipped on without much thought. A malicious/compromised website can make HTTP requests to `localhost`. Normally, such requests would trigger a CORS preflight check which would prevent the request; however, some requests are "simple" and do not require a preflight check. These endpoints, if enabled and not secured, are vulnerable to being triggered. Production environments typically disable unused endpoints and secure/restrict access to needed endpoints. A more likely victim is the developer in their local development host, who has enabled endpoints without security for the sake of easing development. This issue has been addressed in version 3.8.3. Users are advised to upgrade.
- Product
- micronaut-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.mozilla.orggithub.com
Jan 29, 2024The Moderna Sistemas ModernaNet Hospital Management System 2024 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability.CVE-2024-23747 · Other software · Modernasistemas · reported by MITREHigh 7.5
The Moderna Sistemas ModernaNet Hospital Management System 2024 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability. This vulnerability resides in the system's handling of user data access through a /Modernanet/LAUDO/LAU0000100/Laudo?id= URI. By manipulating this id parameter, an attacker can gain access to sensitive medical information.
- Product
- Modernanet Hospital Management System 2024
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commodernasistemas.com.br
Dec 20, 2023Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie.CVE-2023-28025 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.6
Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate stored XSS vulnerabilities, a preventive measure involves thoroughly sanitizing and validating all user inputs before they are processed and stored in the server storage.
- Product
- HCL BigFix Mobile / Modern Client Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Oct 20, 2023Modern Footnotes: Stored Cross-Site ScriptingCVE-2023-5618 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Modern Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in versions up to, and including, 1.4.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Modern Footnotes
- Affected
- up to 1.4.16
- What to do
- Affects up to 1.4.16. Update Modern Footnotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgresearch.cleantalk.org
Oct 20, 2023Modern Events Calendar lite: Stored Cross-Site ScriptingCVE-2023-4021 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Modern Events Calendar lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Google API key and Calendar ID in versions up to, but not including, 7.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Modern Events Calendar lite
- Fixed in
- 7.1.0
- What to do
- Update Modern Events Calendar lite to 7.1.0 or newer.
Full record and what to do →NVD recordwebnus.networdfence.com
Jul 20, 2023 Dell Wyse ThinOS versions prior to 2208 (9.3.2102) contain a sensitive information disclosure vulnerability.CVE-2023-32455 · Other software · Dell · reported by security_alert@emc.comMedium 5.5
Dell Wyse ThinOS versions prior to 2208 (9.3.2102) contain a sensitive information disclosure vulnerability. An unauthenticated malicious user with local access to the device could exploit this vulnerability to read sensitive information written to the log files.
- Product
- Wyse Proprietary OS (Modern ThinOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023 Dell Wyse ThinOS versions prior to 2306 (9.4.2103) contain a sensitive information disclosure vulnerability.CVE-2023-32447 · Other software · Dell · reported by security_alert@emc.comMedium 5.5
Dell Wyse ThinOS versions prior to 2306 (9.4.2103) contain a sensitive information disclosure vulnerability. A malicious user with local access to the device could exploit this vulnerability to read sensitive information written to the log files.
- Product
- Wyse Proprietary OS (Modern ThinOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023 Dell Wyse ThinOS versions prior to 2303 (9.4.1141) contain a sensitive information disclosure vulnerability.CVE-2023-32446 · Other software · Dell · reported by security_alert@emc.comMedium 5.5
Dell Wyse ThinOS versions prior to 2303 (9.4.1141) contain a sensitive information disclosure vulnerability. An unauthenticated malicious user with local access to the device could exploit this vulnerability to read sensitive information written to the log files.
- Product
- Wyse Proprietary OS (Modern ThinOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2023Knowage is the professional open source suite for modern business analytics over traditional sources and big data systems.CVE-2023-36819 · Other software · KnowageLabs · reported by GitHubMedium 6.5
Knowage is the professional open source suite for modern business analytics over traditional sources and big data systems. The endpoint `_/knowage/restful-services/dossier/importTemplateFile_` allows authenticated users to download template hosted on the server. However, starting in the 6.x.x branch and prior to version 8.1.8, the application does not sanitize the `_templateName_ `parameter allowing an attacker to use `*../*` in it, and escaping the directory the template are normally placed and download any file from the system. This vulnerability allows a low privileged attacker to exfiltrate sensitive configuration file. This issue has been patched in Knowage version 8.1.8.
- Product
- Knowage-Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2023mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI for user/server administration.CVE-2023-34108 · Other software · mailcow · reported by GitHubHigh 8.8
mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI for user/server administration. A vulnerability has been discovered in mailcow which allows an attacker to manipulate internal Dovecot variables by using specially crafted passwords during the authentication process. The issue arises from the behavior of the `passwd-verify.lua` script, which is responsible for verifying user passwords during login attempts. Upon a successful login, the script returns a response in the format of "password=<valid-password>", indicating the successful authentication. By crafting a password with additional key-value pairs appended to it, an attacker can manipulate the returned string and influence the internal behavior of Dovecot. For example, using the password "123 mail_crypt_save_version=0" would cause the `passwd-verify.lua` script to return the string "password=123 mail_crypt_save_version=0". Consequently, Dovecot will interpret this string and set the internal variables accordingly, leading to unintended consequences. This vulnerability can be exploited by an authenticated attacker who has the ability to set their own password. S
- Product
- mailcow-dockerized
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer for deploying microservices.CVE-2023-29013 · Other software · traefik · reported by GitHubHigh 7.5
Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer for deploying microservices. There is a vulnerability in Go when parsing the HTTP headers, which impacts Traefik. HTTP header parsing could allocate substantially more memory than required to hold the parsed headers. This behavior could be exploited to cause a denial of service. This issue has been patched in versions 2.9.10 and 2.10.0-rc2.
- Product
- traefik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023Modern Events Calendar Lite: Does not sanitise and escape some of its settingsCVE-2023-1400 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Modern Events Calendar Lite WordPress plugin before 6.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Modern Events Calendar Lite
- Fixed in
- 6.5.2
- What to do
- Update Modern Events Calendar Lite to 6.5.2 or newer.
Mar 24, 2023Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust.CVE-2023-28446 · Other software · denoland · reported by GitHubHigh 8.8
Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary program names without any ANSI filtering allows any malicious program to clear the first 2 lines of a `op_spawn_child` or `op_kill` prompt and replace it with any desired text. This works with any command on the respective platform, giving the program the full ability to choose what program they wanted to run. This problem can not be exploited on systems that do not attach an interactive prompt (for example headless servers). This issue has been patched in version 1.31.2.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023Incorrect Access Control vulnerability in Modern Honey Network commit 0abf0db9cd893c6d5c727d036e1f817c02de4c7b allows remote attackers to view sensitive informaCVE-2021-37234 · Other software · Modern Honey Network Project · reported by MITREMedium 6.5
Incorrect Access Control vulnerability in Modern Honey Network commit 0abf0db9cd893c6d5c727d036e1f817c02de4c7b allows remote attackers to view sensitive information via crafted PUT request to Web API.
- Product
- Modern Honey Network
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2023HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced.CVE-2021-27782 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.4
HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple invalid attempts.
- Product
- BigFix Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jan 19, 2023A vulnerability was found in gitter-badger ezpublish-modern-legacy.CVE-2015-10071 · Other software · gitter-badger · reported by VulDBLow 2.6
A vulnerability was found in gitter-badger ezpublish-modern-legacy. It has been rated as problematic. This issue affects some unknown processing of the file kernel/user/forgotpassword.php. The manipulation leads to weak password recovery. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 1.0 is able to address this issue. The patch is named 5908d5ee65fec61ce0e321d586530461a210bf2a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218951.
- Product
- ezpublish-modern-legacy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2023KubePi is a modern Kubernetes panel.CVE-2023-22478 · Other software · KubeOperator · reported by GitHubHigh 7.3
KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.
- Product
- KubePi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2023KubePi is a modern Kubernetes panel.CVE-2023-22479 · Other software · KubeOperator · reported by GitHubHigh 7.5
KubePi is a modern Kubernetes panel. A session fixation attack allows an attacker to hijack a legitimate user session, versions 1.6.3 and below are susceptible. A patch will be released in version 1.6.4.
- Product
- KubePi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022A vulnerability classified as critical has been found in Modern Tribe Panel Builder Plugin.CVE-2020-36626 · Other software · Modern Tribe · reported by VulDBMedium 5.5
A vulnerability classified as critical has been found in Modern Tribe Panel Builder Plugin. Affected is the function add_post_content_filtered_to_search_sql of the file ModularContent/SearchFilter.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 4528d4f855dbbf24e9fc12a162fda84ce3bedc2f. It is recommended to apply a patch to fix this issue. VDB-216738 is the identifier assigned to this vulnerability.
- Product
- Panel Builder Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2022Knowage is an open source suite for modern business analytics alternative over big data systems.CVE-2022-39295 · Other software · KnowageLabs · reported by GitHubMedium 6.1
Knowage is an open source suite for modern business analytics alternative over big data systems. KnowageLabs / Knowage-Server starting with the 6.x branch and prior to versions 7.4.22, 8.0.9, and 8.1.0 is vulnerable to cross-site scripting because the `XSSRequestWrapper::stripXSS` method can be bypassed. Versions 7.4.22, 8.0.9, and 8.1.0 contain patches for this issue. There are no known workarounds.
- Product
- Knowage-Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer that assists in deploying microservices.CVE-2022-39271 · Other software · traefik · reported by GitHubHigh 7.5
Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer that assists in deploying microservices. There is a potential vulnerability in Traefik managing HTTP/2 connections. A closing HTTP/2 server connection could hang forever because of a subsequent fatal error. This failure mode could be exploited to cause a denial of service. There has been a patch released in versions 2.8.8 and 2.9.0-rc5. There are currently no known workarounds.
- Product
- traefik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2022Dell Wyse ThinOS 2205 contains a Regular Expression Denial of Service Vulnerability in UI.CVE-2022-34402 · Other software · Dell · reported by security_alert@emc.comMedium 6.8
Dell Wyse ThinOS 2205 contains a Regular Expression Denial of Service Vulnerability in UI. An admin privilege attacker could potentially exploit this vulnerability, leading to denial-of-service.
- Product
- Wyse Proprietary OS (Modern ThinOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2022Slack Morphism is a modern client library for Slack Web/Events API/Socket Mode and Block Kit.CVE-2022-39292 · Other software · abdolence · reported by GitHubHigh 7.5
Slack Morphism is a modern client library for Slack Web/Events API/Socket Mode and Block Kit. Debug logs expose sensitive URLs for Slack webhooks that contain private information. The problem is fixed in version 1.3.2 which redacts sensitive URLs for webhooks. As a workaround, people who use Slack webhooks may disable or filter debug logs.
- Product
- slack-morphism-rust
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2022Modern Campus Omni CMS (formerly OU Campus) 10.2.4 allows login-page SQL injection via a '" OR 1 = 1 -- - , <?php' substring.CVE-2022-40766 · Other software · Moderncampus · reported by MITRECritical 9.8
Modern Campus Omni CMS (formerly OU Campus) 10.2.4 allows login-page SQL injection via a '" OR 1 = 1 -- - , <?php' substring.
- Product
- Omni CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.commoderncampus.com
Jun 15, 2022Cross-site scripting vulnerability in Modern Events Calendar Lite versions prior to 6.3.0 allows remote an authenticated attacker to inject an arbitrary script CVE-2022-30533 · Other software · Webnus · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in Modern Events Calendar Lite versions prior to 6.3.0 allows remote an authenticated attacker to inject an arbitrary script via unspecified vectors.
- Product
- Modern Events Calendar Lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022A reflected cross-site scripting (XSS) vulnerability exists in the playerConfUrl parameter in the /defaultui/player/modern.html file for SCORM Engine versions <CVE-2022-2035 · Other software · Ltgplc · reported by vulnreport@tenable.comMedium 6.1
A reflected cross-site scripting (XSS) vulnerability exists in the playerConfUrl parameter in the /defaultui/player/modern.html file for SCORM Engine versions < 20.1.45.914, 21.1.x < 21.1.7.219. The issue exists because there are no limitations on the domain or format of the url supplied by the user, allowing an attacker to craft malicious urls which can trigger a reflected XSS payload in the context of a victim's browser.
- Product
- Rustici Software Scorm Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
May 27, 2022The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.CVE-2021-27781 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.6
The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.
- Product
- HCL BigFix Mobile / Modern Client Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 27, 2022The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.CVE-2021-27780 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.3
The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.
- Product
- HCL BigFix Mobile / Modern Client Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
May 25, 2022User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed.CVE-2021-27783 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.8
User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed.
- Product
- HCL BigFix Mobile / Modern Client Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Apr 14, 2022Authenticated (admin+ user) Stored Cross-Site Scripting (XSS) in Modern Events Calendar Lite (WordPress plugin) <= 6.5.1CVE-2022-27848 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (admin+ user) Stored Cross-Site Scripting (XSS) in Modern Events Calendar Lite (WordPress plugin) <= 6.5.1
- Affected
- up to 6.5.1
- What to do
- Affects up to 6.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 11, 2022JHipster is a development platform to quickly generate, develop, & deploy modern web applications & microservice architectures.CVE-2022-24815 · Other software · jhipster · reported by GitHubHigh 8.1
JHipster is a development platform to quickly generate, develop, & deploy modern web applications & microservice architectures. SQL Injection vulnerability in entities for applications generated with the option "reactive with Spring WebFlux" enabled and an SQL database using r2dbc. Applications created without "reactive with Spring WebFlux" and applications with NoSQL databases are not affected. Users who have generated a microservice Gateway using the affected version may be impacted as Gateways are reactive by default. Currently, SQL injection is possible in the findAllBy(Pageable pageable, Criteria criteria) method of an entity repository class generated in these applications as the where clause using Criteria for queries are not sanitized and user input is passed on as it is by the criteria. This issue has been patched in v7.8.1. Users unable to upgrade should be careful when combining criterias and conditions as the root of the issue lies in the `EntityManager.java` class when creating the where clause via `Conditions.just(criteria.toString())`. `just` accepts the literal string provided. Criteria's `toString` method returns a plain string and this combination is vulnerable to
- Product
- generator-jhipster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2022Modern Events Calendar Lite: Does not sanitize and escape some of the Hourly Schedule parametersCVE-2022-0364 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Modern Events Calendar Lite WordPress plugin before 6.4.0 does not sanitize and escape some of the Hourly Schedule parameters which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Modern Events Calendar Lite
- Fixed in
- 6.4.0
- What to do
- Update Modern Events Calendar Lite to 6.4.0 or newer.
Jan 17, 2022Modern Events Calendar Lite: Alloed any logged-in userCVE-2021-25046 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Modern Events Calendar Lite WordPress plugin before 6.2.0 alloed any logged-in user, even a subscriber user, may add a category whose parameters are incorrectly escaped in the admin panel, leading to stored XSS.
- Product
- Modern Events Calendar Lite
- Fixed in
- 6.2.0
- What to do
- Update Modern Events Calendar Lite to 6.2.0 or newer.
Jan 11, 2022Windows Modern Execution Server Remote Code Execution VulnerabilityCVE-2022-21888 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Modern Execution Server Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Dec 13, 2021Modern Events Calendar Lite: Does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX actionCVE-2021-24946 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue
- Product
- Modern Events Calendar Lite
- Fixed in
- 6.1.5
- What to do
- Update Modern Events Calendar Lite to 6.1.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Dec 13, 2021Modern Events Calendar Lite: Does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in tCVE-2021-24925 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
- Product
- Modern Events Calendar Lite
- Fixed in
- 6.1.5
- What to do
- Update Modern Events Calendar Lite to 6.1.5 or newer.
Nov 16, 2021Modern DRAM devices (PC-DDR4, LPDDR4X) are affected by a vulnerability in their internal Target Row Refresh (TRR) mitigation against Rowhammer attacks.CVE-2021-42114 · Other software · Micron · reported by vulnerability@ncsc.chCritical 9
Modern DRAM devices (PC-DDR4, LPDDR4X) are affected by a vulnerability in their internal Target Row Refresh (TRR) mitigation against Rowhammer attacks. Novel non-uniform Rowhammer access patterns, consisting of aggressors with different frequencies, phases, and amplitudes allow triggering bit flips on affected memory modules using our Blacksmith fuzzer. The patterns generated by Blacksmith were able to trigger bitflips on all 40 PC-DDR4 DRAM devices in our test pool, which cover the three major DRAM manufacturers: Samsung, SK Hynix, and Micron. This means that, even when chips advertised as Rowhammer-free are used, attackers may still be able to exploit Rowhammer. For example, this enables privilege-escalation attacks against the kernel or binaries such as the sudo binary, and also triggering bit flips in RSA-2048 keys (e.g., SSH keys) to gain cross-tenant virtual-machine access. We can confirm that DRAM devices acquired in July 2020 with DRAM chips from all three major DRAM vendors (Samsung, SK Hynix, Micron) are affected by this vulnerability. For more details, please refer to our publication.
- Product
- Micron ddr4_sdram
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcomsec.ethz.chcomsec.ethz.ch
Nov 1, 2021Modern Events Calendar Lite: Does not properly sanitize or escape values set by users with access to adjust settings withing wp-adminCVE-2021-24716 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin.
- Product
- Modern Events Calendar Lite
- Fixed in
- 5.22.3
- What to do
- Update Modern Events Calendar Lite to 5.22.3 or newer.
Oct 20, 2021modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises.CVE-2021-41167 · Other software · nicolas-van · reported by GitHubHigh 7.5
modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they don't. Any code calling these functions will be written thinking they would limit the concurrency but they won't. This could lead to potential security issues in other projects. The problem has been patched in 1.0.4. There is no workaround.
- Product
- modern-async
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Modern Events Calendar Lite: Does not escape some of its settings before outputting them in attributesCVE-2021-24687 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Modern Events Calendar Lite WordPress plugin before 5.22.2 does not escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Modern Events Calendar Lite
- Fixed in
- 5.22.2
- What to do
- Update Modern Events Calendar Lite to 5.22.2 or newer.
Aug 24, 2021Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures.CVE-2021-32781 · Other software · envoyproxy · reported by GitHubHigh 8.6
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after Envoy sends a locally generated response it must stop further processing of request or response data. However when local response is generated due the internal buffer overflow while request or response is processed by the filter chain the operation may not be stopped completely and result in accessing a freed memory block. A specifically constructed request delivered by an untrusted downstream or upstream peer in the presence of extensions that modify and increase the size of request or response bodies resulting in a Denial of Service when using extensions that modify and increase the size of request or response bodies, such as decompressor filter. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to address incomplete termination of request processing after locally generated response. As a workaround disable Envoy's decompressor, json-transcoder or grpc-web extensions or proprietary extensions that modify and increase the size of request or response bodies, if feasible.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comenvoyproxy.io
Aug 24, 2021Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures.CVE-2021-32780 · Other software · envoyproxy · reported by GitHubHigh 8.6
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions Envoy transitions a H/2 connection to the CLOSED state when it receives a GOAWAY frame without any streams outstanding. The connection state is transitioned to DRAINING when it receives a SETTING frame with the SETTINGS_MAX_CONCURRENT_STREAMS parameter set to 0. Receiving these two frames in the same I/O event results in abnormal termination of the Envoy process due to invalid state transition from CLOSED to DRAINING. A sequence of H/2 frames delivered by an untrusted upstream server will result in Denial of Service in the presence of untrusted **upstream** servers. Envoy versions 1.19.1, 1.18.4 contain fixes to stop processing of pending H/2 frames after connection transition to the CLOSED state.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comenvoyproxy.io
Aug 24, 2021Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures.CVE-2021-32779 · Other software · envoyproxy · reported by GitHubHigh 8.6
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy incorrectly handled a URI '#fragment' element as part of the path element. Envoy is configured with an RBAC filter for authorization or similar mechanism with an explicit case of a final "/admin" path element, or is using a negative assertion with final path element of "/admin". The client sends request to "/app1/admin#foo". In Envoy prior to 1.18.0, or 1.18.0+ configured with path_normalization=false. Envoy treats fragment as a suffix of the query string when present, or as a suffix of the path when query string is absent, so it evaluates the final path element as "/admin#foo" and mismatches with the configured "/admin" path element. In Envoy 1.18.0+ configured with path_normalization=true. Envoy transforms this to /app1/admin%23foo and mismatches with the configured /admin prefix. The resulting URI is sent to the next server-agent with the offending "#foo" fragment which violates RFC3986 or with the nonsensical "%23foo" text appended. A specifically constructed request with URI containing '#fragment' element delivered by an untrusted client i
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comenvoyproxy.io
Aug 24, 2021Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures.CVE-2021-32778 · Other software · envoyproxy · reported by GitHubMedium 5.8
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’s procedure for resetting a HTTP/2 stream has O(N^2) complexity, leading to high CPU utilization when a large number of streams are reset. Deployments are susceptible to Denial of Service when Envoy is configured with high limit on H/2 concurrent streams. An attacker wishing to exploit this vulnerability would require a client opening and closing a large number of H/2 streams. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to reduce time complexity of resetting HTTP/2 streams. As a workaround users may limit the number of simultaneous HTTP/2 dreams for upstream and downstream peers to a low number, i.e. 100.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comenvoyproxy.io
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.