Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

350 results · page 4 of 7

Sep 26, 2024A host header injection vulnerability in scheduleR v0.0.18 allows attackers to obtain the password reset token via user interaction with a crafted password reseCVE-2024-45982 · Other software · scheduler · reported by MITREHigh 8.8
A host header injection vulnerability in scheduleR v0.0.18 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts.
Product
scheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Sep 7, 2024Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler,CVE-2024-45034 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.
Product
Apache Airflow
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.apache.org
Sep 4, 2024IBM webMethods Integration 10.15 could allow an authenticated user to create scheduler tasks that would allow them to escalate their privileges to administratorCVE-2024-45075 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM webMethods Integration 10.15 could allow an authenticated user to create scheduler tasks that would allow them to escalate their privileges to administrator due to missing authentication.
Product
webMethods Integration
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com
Aug 20, 2024Exposure of Remote Code Execution in Apache Dolphinscheduler.CVE-2024-43202 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.2. We recommend users to upgrade Apache DolphinScheduler to version 3.2.2, which fixes the issue.
Product
Apache DolphinScheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.apache.org
Aug 12, 2024File read and write vulnerability in Apache DolphinScheduler , authenticated users can illegally access additional resource files.CVE-2024-30188 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.1
File read and write vulnerability in Apache DolphinScheduler , authenticated users can illegally access additional resource files. This issue affects Apache DolphinScheduler: from 3.1.0 before 3.2.2. Users are recommended to upgrade to version 3.2.2, which fixes the issue.
Product
Apache DolphinScheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Aug 12, 2024Improper Input Validation vulnerability in Apache DolphinScheduler.CVE-2024-29831 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2.
Product
Apache DolphinScheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Aug 1, 2024Blog2Social: Social Media Auto Post & Scheduler: Stored Cross-Site ScriptingCVE-2024-7302 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 3gp2 file uploads in all versions up to, and including, 7.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the 3gp2 file.
Product
Blog2Social: Social Media Auto Post & Scheduler
Affected
up to 7.5.4
What to do
Affects up to 7.5.4. Update Blog2Social: Social Media Auto Post & Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 11, 2024Blog2Social: Social Media Auto Post & Scheduler: SQL InjectionCVE-2024-3549 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the 'b2sSortPostType' parameter in all versions up to, and including, 7.4.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Blog2Social: Social Media Auto Post & Scheduler
Affected
up to 7.4.1
What to do
Affects up to 7.4.1. Update Blog2Social: Social Media Auto Post & Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 23, 2024Jupyter Scheduler is collection of extensions for programming jobs to run now or run on a schedule.CVE-2024-28188 · Other software · jupyter-server · reported by GitHubMedium 5.3
Jupyter Scheduler is collection of extensions for programming jobs to run now or run on a schedule. The list of conda environments of `jupyter-scheduler` users maybe be exposed, potentially revealing information about projects that a specific user may be working on. This vulnerability has been patched in version(s) 1.1.6, 1.2.1, 1.8.2 and 2.5.2.
Product
jupyter-scheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 20, 2024In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix transmit scheduler resource leak Inorder to support shaping and scheduliCVE-2024-35975 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix transmit scheduler resource leak Inorder to support shaping and scheduling, Upon class creation Netdev driver allocates trasmit schedulers. The previous patch which added support for Round robin scheduling has a bug due to which driver is not freeing transmit schedulers post class deletion. This patch fixes the same.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
May 14, 2024Microsoft PLUGScheduler Scheduled Task Elevation of Privilege VulnerabilityCVE-2024-26238 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft PLUGScheduler Scheduled Task Elevation of Privilege Vulnerability
Product
Windows 10 Version 21H2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
May 14, 2024WPCal.Io – Easy Meeting Scheduler: Cross-Site Request Forgery (CSRF)CVE-2024-34816 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Revmakx WPCal.Io – Easy Meeting Scheduler.This issue affects WPCal.Io – Easy Meeting Scheduler: from n/a through 0.9.5.8.
Product
WPCal.Io – Easy Meeting Scheduler
Affected
up to 0.9.5.8
What to do
Affects up to 0.9.5.8. Update WPCal.Io – Easy Meeting Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 2, 2024Voltronic Power ViewPower UpsScheduler Exposed Dangerous Method Remote Code Execution Vulnerability.CVE-2023-51583 · Other software · Voltronic Power · reported by zdi-disclosures@trendmicro.comCritical 9.8
Voltronic Power ViewPower UpsScheduler Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UpsScheduler class. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-22036.
Product
ViewPower
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
Apr 26, 2024Blog2Social: Social Media Auto Post & Scheduler: Sensitive Information ExposureCVE-2024-3678 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2. This makes it possible for unauthenticated attackers to view limited information from password protected posts.
Product
Blog2Social: Social Media Auto Post & Scheduler
Affected
up to 7.4.2
What to do
Affects up to 7.4.2. Update Blog2Social: Social Media Auto Post & Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 24, 2024WPCal.Io – Easy Meeting Scheduler: Cross-Site Request Forgery (CSRF)CVE-2024-32795 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Revmakx WPCal.Io – Easy Meeting Scheduler.This issue affects WPCal.Io – Easy Meeting Scheduler: from n/a through 0.9.5.8.
Product
WPCal.Io – Easy Meeting Scheduler
Affected
up to 0.9.5.8
What to do
Affects up to 0.9.5.8. Update WPCal.Io – Easy Meeting Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 23, 2024Improper Input Validation vulnerability in Apache DolphinScheduler.CVE-2024-23320 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it. This issue affects Apache DolphinScheduler: until 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue.
Product
Apache DolphinScheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Feb 20, 2024Arbitrary File Read Vulnerability in Apache Dolphinscheduler.CVE-2023-51770 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Arbitrary File Read Vulnerability in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.
Product
Apache DolphinScheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Feb 20, 2024Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.CVE-2023-50270 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue.
Product
Apache DolphinScheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.apache.org
Feb 20, 2024Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could imCVE-2023-49250 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.3
Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.0. Users are recommended to upgrade to version 3.2.1, which fixes the issue.
Product
Apache DolphinScheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Feb 20, 2024Exposure of Remote Code Execution in Apache Dolphinscheduler.CVE-2023-49109 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.
Product
Apache DolphinScheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Feb 15, 2024In removePersistentDot of SystemStatusAnimationSchedulerImpl.kt, there is a possible race condition due to a logic error in the code.CVE-2024-0041 · Computers, phones & browsers · Google · reported by security@android.comHigh 7
In removePersistentDot of SystemStatusAnimationSchedulerImpl.kt, there is a possible race condition due to a logic error in the code. This could lead to local escalation of privilege that fails to remove the persistent dot with no additional execution privileges needed. User interaction is not needed for exploitation.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record android.googlesource.com source.android.com
Dec 30, 2023Improper Input Validation vulnerability in Apache DolphinScheduler.CVE-2023-49299 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to version 3.1.9, which fixes the issue.
Product
Apache DolphinScheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Dec 20, 2023Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the rebootTime parameter in the sysScheduleRebootSet function.CVE-2023-50990 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the rebootTime parameter in the sysScheduleRebootSet function.
Product
I29 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 20, 2023Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the sysScheduleRebootSet function.CVE-2023-50983 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the sysScheduleRebootSet function.
Product
I29 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 7, 2023Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.CVE-2023-48841 · Websites & servers · Phpjabbers · reported by MITREHigh 8.8
Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.
Product
Appointment Scheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com phpjabbers.com
Dec 7, 2023A lack of rate limiting in pjActionAjaxSend in Appointment Scheduler 3.0 allows attackers to cause resource exhaustion.CVE-2023-48840 · Websites & servers · Phpjabbers · reported by MITREHigh 7.5
A lack of rate limiting in pjActionAjaxSend in Appointment Scheduler 3.0 allows attackers to cause resource exhaustion.
Product
Appointment Scheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com phpjabbers.com
Dec 7, 2023Appointment Scheduler 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendarCVE-2023-48839 · Websites & servers · Phpjabbers · reported by MITREMedium 5.4
Appointment Scheduler 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id, title, country name, or customer_name parameter.
Product
Appointment Scheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com phpjabbers.com
Dec 7, 2023Appointment Scheduler 3.0 is vulnerable to Multiple HTML Injection issues via the SMS API Key or Default Country Code.CVE-2023-48838 · Websites & servers · Phpjabbers · reported by MITREMedium 5.4
Appointment Scheduler 3.0 is vulnerable to Multiple HTML Injection issues via the SMS API Key or Default Country Code.
Product
Appointment Scheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com phpjabbers.com
Nov 30, 2023Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthCVE-2023-49620 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability
Product
Apache DolphinScheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Nov 27, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1.CVE-2023-49068 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not yet been released. In the mean time, we recommend you make sure the logs are only available to trusted operators.
Product
Apache DolphinScheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.apache.org
Nov 24, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.CVE-2023-48796 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable `MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus` to workaround this, or add the following section in the `application.yaml` file ``` management: endpoints: web: exposure: include: health,metrics,prometheus ``` This issue affects Apache DolphinScheduler: from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2, which fixes the issue.
Product
Apache DolphinScheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Oct 30, 2023In Job Scheduler, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.CVE-2023-21344 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In Job Scheduler, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Oct 10, 2023User enumeration is found in in PHPJabbers Appointment Scheduler 3.0.CVE-2023-36127 · Websites & servers · Phpjabbers · reported by MITREHigh 7.5
User enumeration is found in in PHPJabbers Appointment Scheduler 3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
Product
Appointment Scheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record medium.com medium.com
Oct 10, 2023There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Appointment Scheduler v3.0CVE-2023-36126 · Websites & servers · Phpjabbers · reported by MITREMedium 6.1
There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Appointment Scheduler v3.0
Product
Appointment Scheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record medium.com medium.com
Oct 10, 2023Azure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege VulnerabilityCVE-2023-36419 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Azure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege Vulnerability
Product
Azure HDInsight
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Aug 9, 2023A command injection vulnerability exists in the dashboard scheduler feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it dCVE-2022-48583 · Other software · ScienceLogic · reported by contact@securifera.comHigh 8.8
A command injection vulnerability exists in the dashboard scheduler feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system.
Product
SL 1
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securifera.com securifera.com
Jul 13, 2023JS7 is an Open Source Job Scheduler.CVE-2023-37272 · Other software · sos-berlin · reported by GitHubMedium 6.3
JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. Risk of the vulnerability is considered high for branch 1.13 of JobScheduler (JS1). The vulnerability does not affect branch 2.x of JobScheduler (JS7) for releases after 2.1.0. The vulnerability is resolved with release 1.13.19.
Product
joc-cockpit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record change.sos-berlin.com github.com
Jun 2, 2023eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /scheduler/indeCVE-2023-33763 · Other software · Simpleredak · reported by MITREMedium 6.1
eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /scheduler/index.php.
Product
Simpleredak
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 20, 2023On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack withCVE-2023-25601 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.3
On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack without authentication. This issue has been fixed from version 3.1.2 onwards. For users who use version 3.0.0 to 3.1.1, you can turn off the python-gateway function by changing the value `python-gateway.enabled=false` in configuration file `application.yaml`. If you are using the python gateway, please upgrade to version 3.1.2 or above.
Product
Apache DolphinScheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Apr 4, 2023A reflected XSS via POST vulnerability in report scheduler of Sophos Web Appliance versions older than 4.3.10.4 allows execution of JavaScript code in the victiCVE-2020-36692 · Network & remote access · Sophos · reported by security-alert@sophos.comMedium 6.5
A reflected XSS via POST vulnerability in report scheduler of Sophos Web Appliance versions older than 4.3.10.4 allows execution of JavaScript code in the victim browser via a malicious form that must be manually submitted by the victim while logged in to SWA.
Product
Sophos Web Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sophos.com sophos.com
Feb 2, 2023IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.CVE-2022-38389 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.1
IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 233975.
Product
Tivoli Workload Scheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Feb 2, 2023IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.CVE-2022-22486 · Other software · IBM · reported by psirt@us.ibm.comCritical 10
IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 226328.
Product
Tivoli Workload Scheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Jan 22, 2023Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId value to reservation_save.php.CVE-2023-24058 · Other software · Twinkletoessoftware · reported by MITREMedium 4.3
Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId value to reservation_save.php. NOTE: 2.5.5 is a version from 2014; the latest version of Booked Scheduler is not affected. However, LabArchives Scheduler (Sep 6, 2022 Feature Release) is affected.
Product
Booked
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 10, 2023Windows Task Scheduler Elevation of Privilege VulnerabilityCVE-2023-21541 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Task Scheduler Elevation of Privilege Vulnerability
Product
Windows 10 Version 1809
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Jan 4, 2023Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability.CVE-2022-45875 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. This attack can be performed only by authenticated users which can login to DS.
Product
Apache DolphinScheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Dec 13, 2022Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS).CVE-2022-44303 · Other software · Resque-scheduler Project · reported by MITREMedium 6.1
Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS). A remote attacker could inject javascript code to the "{schedule_job}" or "args" parameter in /resque/delayed/jobs/{schedule_job}?args={args_id} to execute javascript at client side.
Product
Resque-scheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record trungvm.gitbook.io trungvm.gitbook.io
Nov 24, 2022When using tasks to read config files, there is a risk of database password disclosure.CVE-2022-26885 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher.
Product
Apache DolphinScheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
Nov 23, 2022Alarm instance management has command injection when there is a specific command configured.CVE-2022-45462 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher
Product
Apache DolphinScheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Nov 1, 2022When users add resources to the resource center with a relation path will cause path traversal issues and only for logged-in users.CVE-2022-34662 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
When users add resources to the resource center with a relation path will cause path traversal issues and only for logged-in users. You could upgrade to version 3.0.0 or higher
Product
Apache DolphinScheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Nov 1, 2022A cross-site scripting (XSS) vulnerability in /admin/add-fee.php of Train Scheduler App v1.0 allows attackers to execute arbitrary web scripts or HTML via a craCVE-2022-43079 · Other software · Train Scheduler App Project · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in /admin/add-fee.php of Train Scheduler App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cmddept parameter.
Product
Train Scheduler App
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.