Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
399 results · page 4 of 8
Nov 23, 2022A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon `tailscaled`, which can then be used tCVE-2022-41924 · Other software · tailscale · reported by GitHubCritical 9.6
A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon `tailscaled`, which can then be used to remotely execute code. In the Tailscale Windows client, the local API was bound to a local TCP socket, and communicated with the Windows client GUI in cleartext with no Host header verification. This allowed an attacker-controlled website visited by the node to rebind DNS to an attacker-controlled DNS server, and then make local API requests in the client, including changing the coordination server to an attacker-controlled coordination server. An attacker-controlled coordination server can send malicious URL responses to the client, including pushing executables or installing an SMB share. These allow the attacker to remotely execute code on the node. All Windows clients prior to version v.1.32.3 are affected. If you are running Tailscale on Windows, upgrade to v1.32.3 or later to remediate the issue.
- Product
- tailscale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2022SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information.CVE-2022-4093 · Other software · dolibarr · reported by security@huntr.devCritical 9.8
SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-profile data breaches in recent years have been the result of SQL injection attacks, leading to reputational damage and regulatory fines. In some cases, an attacker can obtain a persistent backdoor into an organization's systems, leading to a long-term compromise that can go unnoticed for an extended period. This affect 16.0.1 and 16.0.2 only. 16.0.0 or lower, and 16.0.3 or higher are not affected
- Product
- dolibarr/dolibarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022Simple Cold Storage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=bookings/view_details.CVE-2022-43230 · Other software · Simple Cold Storage Management System Project · reported by MITREHigh 7.2
Simple Cold Storage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=bookings/view_details.
- Product
- Simple Cold Storage Managment System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2022It may be possible to gain some details of the deployment through a well-crafted attack.CVE-2022-24669 · Other software · ForgeRock · reported by psirt@forgerock.comMedium 6.5
It may be possible to gain some details of the deployment through a well-crafted attack. This may allow that data to be used to probe internal network services.
- Product
- Access Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbackstage.forgerock.combackstage.forgerock.com
Oct 20, 2022Best Student Result Management System v1.0 is vulnerable to SQL Injection via /upresult/upresult/notice-details.php?nid=.CVE-2022-42021 · Other software · Best Student Result Management System Project · reported by MITRECritical 9.8
Best Student Result Management System v1.0 is vulnerable to SQL Injection via /upresult/upresult/notice-details.php?nid=.
- Product
- Best Student Result Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2022Cross-site scripting (XSS) vulnerability in the Object module's edit object details page in Liferay Portal 7.4.3.4 through 7.4.3.36 allows remote attackers to iCVE-2022-42115 · Other software · Liferay · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in the Object module's edit object details page in Liferay Portal 7.4.3.4 through 7.4.3.36 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the object field's `Label` text field.
- Product
- Liferay Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.liferay.devportal.liferay.dev
Oct 6, 2022Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/inquiries/view_details.php?id=.CVE-2022-42250 · Other software · Oretnom23 · reported by MITREHigh 7.2
Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/inquiries/view_details.php?id=.
- Product
- Simple Cold Storage Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2022Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /wedding_details.php.CVE-2022-40483 · Other software · Wedding Planner Project · reported by MITRECritical 9.8
Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /wedding_details.php.
- Product
- Wedding Planner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2022Library Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /librarian/edit_book_details.php.CVE-2022-36657 · Other software · Library Management System Project · reported by MITREMedium 4.8
Library Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /librarian/edit_book_details.php.
- Product
- Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2022Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/studentdetails.php.CVE-2022-36712 · Other software · Library Management System Project · reported by MITRECritical 9.8
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/studentdetails.php.
- Product
- Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2022Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/bookdetails.php.CVE-2022-36711 · Other software · Library Management System Project · reported by MITRECritical 9.8
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/bookdetails.php.
- Product
- Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2022Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/edit_book_details.php.CVE-2022-36709 · Other software · Library Management System Project · reported by MITRECritical 9.8
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/edit_book_details.php.
- Product
- Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2022Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /student/bookdetails.php.CVE-2022-36708 · Other software · Library Management System Project · reported by MITRECritical 9.8
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /student/bookdetails.php.
- Product
- Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2022Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /librarian/studentdetails.php.CVE-2022-36704 · Other software · Library Management System Project · reported by MITREHigh 8.8
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /librarian/studentdetails.php.
- Product
- Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2022In PVRSRVBridgeHeapCfgHeapDetails, there is a possible leak of kernel heap content due to uninitialized data.CVE-2021-0698 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In PVRSRVBridgeHeapCfgHeapDetails, there is a possible leak of kernel heap content due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-236848165
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Aug 21, 2022Multiple SQL injections detected in Bus Pass Management System 1.0 via buspassms/admin/view-enquiry.php, buspassms/admin/pass-bwdates-reports-details.php, buspaCVE-2022-36198 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
Multiple SQL injections detected in Bus Pass Management System 1.0 via buspassms/admin/view-enquiry.php, buspassms/admin/pass-bwdates-reports-details.php, buspassms/admin/changeimage.php, buspassms/admin/search-pass.php, buspassms/admin/edit-category-detail.php, and buspassms/admin/edit-pass-detail.php
- Product
- BUS Pass Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comphpgurukul.com
Aug 17, 2022Clinic's Patient Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via update_medicine_details.php.CVE-2022-35117 · Other software · Oretnom23 · reported by MITREMedium 4.8
Clinic's Patient Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via update_medicine_details.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Packing text box under the Update Medical Details module.
- Product
- Clinic's Patient Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2022A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details.CVE-2022-35651 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 6.1
A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Jun 30, 2022IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14 could allow a remote attacker to gain details of the database, such as type and version, by sendCVE-2022-22494 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14 could allow a remote attacker to gain details of the database, such as type and version, by sending a specially-crafted HTTP request. This information could then be used in future attacks. IBM X-Force ID: 226940.
- Product
- Spectrum Protect Operations Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 29, 2022Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/inquiries/view_details.php.CVE-2022-33042 · Other software · Online Railway Reservation System Project · reported by MITREHigh 7.2
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/inquiries/view_details.php.
- Product
- Online Railway Reservation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a low level user to obtain sensitive information from the details of the 'Cloud Storage' page for whCVE-2021-29768 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a low level user to obtain sensitive information from the details of the 'Cloud Storage' page for which they should not have access. IBM X-Force ID: 202682.
- Product
- Cognos Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comsecurity.netapp.com
Jun 24, 2022XSS in /dashboard/blocks/stacks/view_details/ - old browsers only.CVE-2022-30120 · Other software · Concretecms · reported by support@hackerone.comMedium 6.1
XSS in /dashboard/blocks/stacks/view_details/ - old browsers only. When using an older browser with built-in XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 to allow XSS. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 3.1with CVSS v3.1 Vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. Sanitation has been added where built urls are output. Credit to Credit to Bogdan Tiron from FORTBRIDGE (https://www.fortbridge.co.uk/ ) for reporting
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.concretecms.orgdocumentation.concretecms.org
Jun 21, 2022Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/reservations/view_details.phpCVE-2022-33048 · Other software · Online Railway Reservation System Project · reported by MITREHigh 7.2
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/reservations/view_details.php.
- Product
- Online Railway Reservation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2022KiviCare: Does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details routeCVE-2022-0786 · WordPress plugins & themes · reported by WPScanCritical 9.8
The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route, leading to SQL Injections exploitable by unauthenticated users
- Product
- KiviCare
- Fixed in
- 2.3.9
- What to do
- Update KiviCare to 2.3.9 or newer.
Jun 2, 2022Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=sales/view_details&id.CVE-2022-31994 · Other software · Badminton Center Management System Project · reported by MITREHigh 7.2
Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=sales/view_details&id.
- Product
- Badminton Center Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=service_transactions/view_details&id=.CVE-2022-31998 · Other software · Badminton Center Management System Project · reported by MITREHigh 7.2
Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=service_transactions/view_details&id=.
- Product
- Badminton Center Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/admin/?page=bookings/view_details&id=.CVE-2022-31343 · Other software · Oretnom23 · reported by MITRECritical 9.8
Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/admin/?page=bookings/view_details&id=.
- Product
- Online CAR Wash Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/client_manage_account_details.php?booking_id=31&user_id=CVE-2022-30834 · Other software · Wedding Management System Project · reported by MITREHigh 7.2
Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/client_manage_account_details.php?booking_id=31&user_id=
- Product
- Wedding Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Wedding Management System v1.0 is vulnerable to SQL Injection via Wedding-Management/wedding_details.php.CVE-2022-30831 · Other software · Wedding Management System Project · reported by MITREHigh 7.2
Wedding Management System v1.0 is vulnerable to SQL Injection via Wedding-Management/wedding_details.php.
- Product
- Wedding Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Online Ordering System v1.0 by oretnom23 is vulnerable to SQL Injection via admin/editproductetails.php.CVE-2022-30794 · Other software · Online Ordering System Project · reported by MITREHigh 7.2
Online Ordering System v1.0 by oretnom23 is vulnerable to SQL Injection via admin/editproductetails.php.
- Product
- Online Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/view_details.php:4.CVE-2022-30511 · Other software · School Dormitory Management System Project · reported by MITRECritical 9.8
School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/view_details.php:4.
- Product
- School Dormitory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Jun 2, 2022libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous funCVE-2022-27781 · Other software · Siemens · reported by support@hackerone.comHigh 7.5
libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comlists.debian.org
May 11, 2022It was possible to disclose details of confidential notes created via the API in Gitlab CE/EE affecting all versions from 13.2 prior to 14.8.6, 14.9 prior to 14CVE-2022-1545 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
It was possible to disclose details of confidential notes created via the API in Gitlab CE/EE affecting all versions from 13.2 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1 if an unauthorised project member was tagged in the note.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2022Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view license details.CVE-2022-26777 · Email & office · Zohocorp · reported by MITREMedium 5.3
Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view license details.
- Product
- Manageengine Remote Access Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraxis.commanageengine.com
Apr 16, 2022Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view domain details (such as the username and GUID of an administrator).CVE-2022-26653 · Email & office · Zohocorp · reported by MITREMedium 5.3
Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view domain details (such as the username and GUID of an administrator).
- Product
- Manageengine Remote Access Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraxis.commanageengine.com
Apr 11, 2022Improper access control in GitLab CE/EE versions 10.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows a malicious actor to obtain detailsCVE-2022-1193 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
Improper access control in GitLab CE/EE versions 10.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows a malicious actor to obtain details of the latest commit in a private project via Merge Requests under certain circumstances
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2022OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint.CVE-2022-27110 · Other software · Orangehrm · reported by MITREMedium 5.4
OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint.
- Product
- Orangehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2022Improper access control in Gitlab CE/EE versions 12.7 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1 allowed for project non-members to retrieve issue details whCVE-2022-0390 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
Improper access control in Gitlab CE/EE versions 12.7 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1 allowed for project non-members to retrieve issue details when it was linked to an item from the vulnerability dashboard.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2022IBM SterlingPartner Engagement Manager 6.2.0 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insCVE-2022-22331 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.1
IBM SterlingPartner Engagement Manager 6.2.0 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure direct object vulnerability (IDOR). IBM X-Force ID: 219130.
- Product
- SterlingPartner Engagement Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Mar 23, 2022Money Transfer Management System Version 1.0 allows an authenticated user to inject SQL queries in 'mtms/admin/?page=transaction/view_details' via the 'id' paraCVE-2022-25223 · Other software · Money Transfer Management System Project · reported by help@fluidattacks.comMedium 4.3
Money Transfer Management System Version 1.0 allows an authenticated user to inject SQL queries in 'mtms/admin/?page=transaction/view_details' via the 'id' parameter.
- Product
- Money Transfer Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comfluidattacks.com
Mar 7, 2022WP Visitor Statistics (Real Time Traffic): Does not sanitise and escape the id parameter before using it in a SQL statement via the refUrlDetails AJAX actionCVE-2022-0410 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a SQL statement via the refUrlDetails AJAX action, available to any authenticated user, leading to a SQL injection
- Product
- WP Visitor Statistics (Real Time Traffic)
- Fixed in
- 5.6
- What to do
- Update WP Visitor Statistics (Real Time Traffic) to 5.6 or newer.
Feb 9, 2022A high privileged user who has access to transaction SM59 can read connection details stored with the destination for http calls in SAP NetWeaver Application SeCVE-2022-22545 · Network & remote access · SAP SE · reported by cna@sap.comMedium 4.9
A high privileged user who has access to transaction SM59 can read connection details stored with the destination for http calls in SAP NetWeaver Application Server ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756.
- Product
- SAP NetWeaver Application Server ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Feb 9, 2022S/4HANA Supplier Factsheet exposes the private address and bank details of an Employee Business Partner with Supplier Role, AND Enterprise Search for Customer, CVE-2022-22542 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.5
S/4HANA Supplier Factsheet exposes the private address and bank details of an Employee Business Partner with Supplier Role, AND Enterprise Search for Customer, Supplier and Business Partner objects exposes the private address fields of Employee Business Partners, to an actor that is not explicitly authorized to have access to that information, which could compromise Confidentiality.
- Product
- SAP S/4HANA (Supplier Factsheet and Enterprise Search for Business Partner, Supplier and Customer)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Jan 11, 2022Apache Guacamole 1.3.0 and older may incorrectly include a private tunnel identifier in the non-private details of some REST responses.CVE-2021-41767 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Apache Guacamole 1.3.0 and older may incorrectly include a private tunnel identifier in the non-private details of some REST responses. This may allow an authenticated user who already has permission to access a particular connection to read from or interact with another user's active use of that same connection.
- Product
- Apache Guacamole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Jan 10, 2022Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view object import configuration details vCVE-2021-43951 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 4.3
Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view object import configuration details via an Information Disclosure vulnerability in the Create Object type mapping feature. The affected versions are before version 4.21.0.
- Product
- Jira Service Management Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.atlassian.comjira.atlassian.com
Dec 27, 2021The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details.CVE-2021-4161 · Other software · Moxa · reported by ics-cert@hq.dhs.govCritical 9.8
The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details. This could give an attacker admin rights through the HTTP web server.
- Product
- MGate MB3180 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2021WP Visitor Statistics (Real Time Traffic): Does not properly sanitise and escape the refUrl in the refDetails AJAX actionCVE-2021-24750 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform SQL injection attacks
- Product
- WP Visitor Statistics (Real Time Traffic)
- Fixed in
- 4.8
- What to do
- Update WP Visitor Statistics (Real Time Traffic) to 4.8 or newer.
Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org
Dec 20, 2021Zoho ManageEngine Access Manager Plus before 4203 allows anyone to view a few data elements (e.g., access control details) and modify a few aspects of the appliCVE-2021-44676 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine Access Manager Plus before 4203 allows anyone to view a few data elements (e.g., access control details) and modify a few aspects of the application state.
- Product
- Manageengine Access Manager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpitstop.manageengine.commanageengine.com
Dec 15, 2021In UserDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack.CVE-2021-1038 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In UserDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-183411279
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 15, 2021In onResume of NotificationAccessDetails.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel CVE-2021-1012 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In onResume of NotificationAccessDetails.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-195412179
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.