Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
240 results · page 4 of 5
Oct 23, 2023The Vue.js Devtools extension was found to leak screenshot data back to a malicious web page via the standard `postMessage()` API.CVE-2023-5718 · Other software · Vue.js · reported by report@snyk.ioMedium 4.3
The Vue.js Devtools extension was found to leak screenshot data back to a malicious web page via the standard `postMessage()` API. By creating a malicious web page with an iFrame targeting a sensitive resource (i.e. a locally accessible file or sensitive website), and registering a listener on the web page, the extension sent messages back to the listener, containing the base64 encoded screenshot data of the sensitive resource.
- Product
- Vue.js devtools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Aug 14, 2023PrivateUploader is an open source image hosting server written in Vue and TypeScript.CVE-2023-40020 · Other software · PrivateUploader · reported by GitHubCritical 9.9
PrivateUploader is an open source image hosting server written in Vue and TypeScript. In affected versions `app/routes/v3/admin.controller.ts` did not correctly verify whether the user was an administrator (High Level) or moderator (Low Level) causing the request to continue processing. The response would be a 403 with ADMIN_ONLY, however, next() would call leading to any updates/changes in the route to process. This issue has been addressed in version 3.2.49. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- PrivateUploader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2023BlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authenticity check for uploaded firmware.CVE-2023-27748 · Other software · Blackvue · reported by MITRECritical 9.8
BlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authenticity check for uploaded firmware. This can allow attackers to upload crafted firmware which contains backdoors and enables arbitrary code execution.
- Product
- Dr750-2ch LTE Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblackvue.comgithub.com
Apr 13, 2023BlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authentication in its web server.CVE-2023-27747 · Other software · Blackvue · reported by MITREHigh 7.5
BlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authentication in its web server. This vulnerability allows attackers to access sensitive information such as configurations and recordings.
- Product
- Dr750-2ch LTE Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblackvue.comgithub.com
Apr 13, 2023BlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily cracked via a brute force attack if the WPA2 hCVE-2023-27746 · Other software · Blackvue · reported by MITRECritical 9.8
BlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily cracked via a brute force attack if the WPA2 handshake is intercepted.
- Product
- Dr750-2ch LTE Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblackvue.comgithub.com
Mar 10, 2023The help page in GigaVUE-FM, when using GigaVUE-OS software version 5.0 202, does not require an authenticated user.CVE-2023-0746 · Other software · Gigamon · reported by cve-coordination@incibe.esMedium 6.3
The help page in GigaVUE-FM, when using GigaVUE-OS software version 5.0 202, does not require an authenticated user. An attacker could enforce a user into inserting malicious JavaScript code into the URI, that could lead to a Reflected Cross site Scripting.
- Product
- GigaVUE-FM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordincibe-cert.esincibe-cert.es
Feb 3, 2023In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability.CVE-2022-47762 · Other software · Gin-vue-admin Project · reported by MITREHigh 7.5
In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability.
- Product
- Gin-vue-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023Shopware is an open source commerce platform based on Symfony Framework and Vue js.CVE-2023-22734 · Other software · shopware · reported by GitHubMedium 4.3
Shopware is an open source commerce platform based on Symfony Framework and Vue js. The newsletter double opt-in validation was not checked properly, and it was possible to skip the complete double opt in process. As a result operators may have inconsistencies in their newsletter systems. This problem has been fixed with version 6.4.18.1. Users are advised to upgrade. Users unable to upgrade may find security measures are available via a plugin for major versions 6.1, 6.2, and 6.3. Users may also disable newsletter registration completely.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Jan 17, 2023Shopware is an open source commerce platform based on Symfony Framework and Vue js.CVE-2023-22733 · Other software · shopware · reported by GitHubLow 2.7
Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions the log module would write out all kind of sent mails. An attacker with access to either the local system logs or a centralized logging store may have access to other users accounts. This issue has been addressed in version 6.4.18.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. Users unable to upgrade may remove from all users the log module ACL rights or disable logging.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.shopware.comdocs.shopware.com
Jan 17, 2023Shopware is an open source commerce platform based on Symfony Framework and Vue js.CVE-2023-22732 · Other software · shopware · reported by GitHubLow 3.7
Shopware is an open source commerce platform based on Symfony Framework and Vue js. The Administration session expiration was set to one week, when an attacker has stolen the session cookie they could use it for a long period of time. In version 6.4.18.1 an automatic logout into the Administration session has been added. As a result the user will be logged out when they are inactive. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Jan 17, 2023Shopware is an open source commerce platform based on Symfony Framework and Vue js.CVE-2023-22731 · Other software · shopware · reported by GitHubCritical 9.9
Shopware is an open source commerce platform based on Symfony Framework and Vue js. In a Twig environment **without the Sandbox extension**, it is possible to refer to PHP functions in twig filters like `map`, `filter`, `sort`. This allows a template to call any global PHP function and thus execute arbitrary code. The attacker must have access to a Twig environment in order to exploit this vulnerability. This problem has been fixed with 6.4.18.1 with an override of the specified filters until the integration of the Sandbox extension has been finished. Users are advised to upgrade. Users of major versions 6.1, 6.2, and 6.3 may also receive this fix via a plugin.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Jan 17, 2023Shopware is an open source commerce platform based on Symfony Framework and Vue js.CVE-2023-22730 · Other software · shopware · reported by GitHubMedium 5.3
Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions It was possible to put the same line item multiple times in the cart using the AP. The Cart Validators checked the line item's individuality and the user was able to bypass quantity limits in sales. This problem has been fixed with version 6.4.18.1. Users on major versions 6.1, 6.2, and 6.3 may also obtain this fix via a plugin.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Dec 26, 2022In Philips (formerly Carestream) Vue MyVue PACS through 12.2.x.x, the VideoStream function allows Path Traversal by authenticated users to access files stored oCVE-2021-39369 · Other software · Philips · reported by MITREMedium 6.5
In Philips (formerly Carestream) Vue MyVue PACS through 12.2.x.x, the VideoStream function allows Path Traversal by authenticated users to access files stored outside of the web root.
- Product
- Myvue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govusa.philips.com
Dec 12, 2022 A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3.CVE-2022-4312 · Other software · ARC Informatique · reported by ics-cert@hq.dhs.govMedium 5.5
A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This could allow an unauthorized user with access the email and short messaging service (SMS) accounts configuration files to discover the associated simple mail transfer protocol (SMTP) account credentials and the SIM card PIN code. Successful exploitation of this vulnerability could allow an unauthorized user access to the underlying email account and SIM card.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpcvuesolutions.compcvuesolutions.com
Dec 12, 2022 An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2.CVE-2022-4311 · Other software · ARC Informatique · reported by ics-cert@hq.dhs.govMedium 4.7
An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This could allow a user with access to the log files to discover connection strings of data sources configured for the DbConnect, which could include credentials. Successful exploitation of this vulnerability could allow other users unauthorized access to the underlying data sources.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpcvuesolutions.compcvuesolutions.com
Oct 25, 2022Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack.CVE-2022-39345 · Other software · flipped-aurora · reported by GitHubCritical 9.8
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch for this issue. There are no workarounds aside from upgrading to a patched version.
- Product
- gin-vue-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2022Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack.CVE-2022-39305 · Other software · flipped-aurora · reported by GitHubCritical 9.8
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Versions prior to 2.5.4 contain a file upload ability. The affected code fails to validate fileMd5 and fileName parameters, resulting in an arbitrary file being read. This issue is patched in 2.5.4b. There are no known workarounds.
- Product
- gin-vue-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2022In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3b are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the "CompressCVE-2022-32176 · Other software · gin-vue-admin · reported by vulnerabilitylab@mend.ioCritical 9
In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3b are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the "Compress Upload" functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the admin's cookie leading to account takeover.
- Product
- gin-vue-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2022In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3beta are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the 'NormaCVE-2022-32177 · Other software · gin-vue-admin · reported by vulnerabilitylab@mend.ioCritical 9
In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3beta are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the 'Normal Upload' functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the admin’s cookie leading to account takeover.
- Product
- gin-vue-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2022The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' functCVE-2022-25873 · Other software · Vuetifyjs · reported by report@snyk.ioMedium 4.6
The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' function within the VCalendar component.
- Product
- Vuetify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2022Cross site scripting (XSS) vulnerability in ouqiang gocron through 1.5.3, allows attackers to execute arbitrary code via scope.row.hostname in web/vue/src/pagesCVE-2022-40365 · Other software · Gocron Project · reported by MITREMedium 6.1
Cross site scripting (XSS) vulnerability in ouqiang gocron through 1.5.3, allows attackers to execute arbitrary code via scope.row.hostname in web/vue/src/pages/taskLog/list.vue.
- Product
- Gocron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2022HireVue Hiring Platform V1.0 suffers from Use of a Broken or Risky Cryptographic Algorithm.CVE-2022-37177 · Other software · Hirevue · reported by MITREHigh 7.5
HireVue Hiring Platform V1.0 suffers from Use of a Broken or Risky Cryptographic Algorithm. NOTE: this is disputed by the vendor for multiple reasons, e.g., it is inconsistent with CVE ID assignment rules for cloud services, and no product with version V1.0 exists. Furthermore, the rail-fence cipher has been removed, and TLS 1.2 is now used for encryption.
- Product
- Hiring Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2022RuoYi v3.8.3 has a Weak password vulnerability in the management system.CVE-2022-37158 · Other software · Iocoder · reported by MITRECritical 9.8
RuoYi v3.8.3 has a Weak password vulnerability in the management system.
- Product
- Ruoyi-vue-pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2022The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belongiCVE-2022-2569 · Other software · ARC Informatique · reported by ics-cert@hq.dhs.govMedium 5.5
The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belonging to legitimate users
- Product
- PcVue 12 OAuth web service configuration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2022Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.CVE-2022-29947 · Other software · Woodpecker-ci · reported by MITREMedium 6.1
Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.
- Product
- Woodpecker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2022Shopware is an open commerce platform based on Symfony Framework and Vue.CVE-2022-24872 · Other software · shopware · reported by GitHubHigh 8.1
Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by admin-api are still usable within normal user session. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Apr 20, 2022Shopware is an open commerce platform based on Symfony Framework and Vue.CVE-2022-24871 · Other software · shopware · reported by GitHubHigh 7.2
Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the Admin SDK functionality on the server to read or update internal resources. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Apr 13, 2022Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack.CVE-2022-24843 · Other software · flipped-aurora · reported by GitHubHigh 7.5
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin 2.50 has arbitrary file read vulnerability due to a lack of parameter validation. This has been resolved in version 2.5.1. There are no known workarounds for this issue.
- Product
- gin-vue-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack.CVE-2022-24844 · Other software · flipped-aurora · reported by GitHubHigh 8.1
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. The problem occurs in the following code in server/service/system/sys_auto_code_pgsql.go, which means that PostgreSQL must be used as the database for this vulnerability to occur. Users must: Require JWT login） and be using PostgreSQL to be affected. This issue has been resolved in version 2.5.1. There are no known workarounds.
- Product
- gin-vue-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2022Philips Vue PACS versions 12.2.x.x and prior transmits or stores authentication credentials, but it uses an insecure method susceptible to unauthorized intercepCVE-2021-33024 · Other software · Philips · reported by ics-cert@hq.dhs.govLow 3.7
Philips Vue PACS versions 12.2.x.x and prior transmits or stores authentication credentials, but it uses an insecure method susceptible to unauthorized interception and/or retrieval.
- Product
- Vue PACS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2022Philips Vue PACS versions 12.2.x.x and prior transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthCVE-2021-33022 · Other software · Philips · reported by ics-cert@hq.dhs.govHigh 7.5
Philips Vue PACS versions 12.2.x.x and prior transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
- Product
- Vue PACS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2022Philips Vue PACS versions 12.2.x.x and prior uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasCVE-2021-33020 · Other software · Philips · reported by ics-cert@hq.dhs.govHigh 8.2
Philips Vue PACS versions 12.2.x.x and prior uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
- Product
- Vue PACS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2022The use of a broken or risky cryptographic algorithm in Philips Vue PACS versions 12.2.x.x and prior is an unnecessary risk that may result in the exposure of sCVE-2021-33018 · Other software · Philips · reported by ics-cert@hq.dhs.govHigh 7.5
The use of a broken or risky cryptographic algorithm in Philips Vue PACS versions 12.2.x.x and prior is an unnecessary risk that may result in the exposure of sensitive information.
- Product
- Vue PACS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2022Philips Vue PACS versions 12.2.x.x and prior does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severiCVE-2021-27501 · Other software · Philips · reported by ics-cert@hq.dhs.govHigh 7.5
Philips Vue PACS versions 12.2.x.x and prior does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.
- Product
- Vue PACS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2022Philips Vue PACS versions 12.2.x.x and prior does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks aCVE-2021-27497 · Other software · Philips · reported by ics-cert@hq.dhs.govMedium 6.5
Philips Vue PACS versions 12.2.x.x and prior does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
- Product
- Vue PACS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2022Philips Vue PACS versions 12.2.x.x and prior does not ensure or incorrectly ensures structured messages or data are well formed and that certain security properCVE-2021-27493 · Other software · Philips · reported by ics-cert@hq.dhs.govMedium 6.1
Philips Vue PACS versions 12.2.x.x and prior does not ensure or incorrectly ensures structured messages or data are well formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
- Product
- Vue PACS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2022Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework.CVE-2022-24748 · Other software · shopware · reported by GitHubMedium 6.8
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it is possible to modify customers and to create orders without App Permission. This issue is a result of improper api route checking. Users are advised to upgrade to version 6.4.8.2. There are no known workarounds.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2022Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework.CVE-2022-24747 · Other software · shopware · reported by GitHubMedium 6.3
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do no properly set sensitive HTTP headers to be non-cacheable. If there is an HTTP cache between the server and client then headers may be exposed via HTTP caches. This issue has been resolved in version 6.4.8.2. There are no known workarounds.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Mar 9, 2022Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework.CVE-2022-24746 · Other software · shopware · reported by GitHubMedium 6.1
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions it is possible to inject code via the voucher code form. This issue has been patched in version 6.4.8.1. There are no known workarounds for this issue.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.shopware.comgithub.com
Mar 9, 2022Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework.CVE-2022-24745 · Other software · shopware · reported by GitHubMedium 4.8
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessions are shared between customers when HTTP cache is enabled. This can lead to inconsistent experiences for guest users. Setups with Varnish are not affected by this issue. This issue has been resolved in version 6.4.8.2. Users unable to upgrade should disable the HTTP Cache.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2022Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework.CVE-2022-24744 · Other software · shopware · reported by GitHubLow 2.6
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Gin-vue-admin is a backstage management system based on vue and gin.CVE-2022-21660 · Other software · flipped-aurora · reported by GitHubHigh 8.1
Gin-vue-admin is a backstage management system based on vue and gin. In versions prior to 2.4.7 low privilege users are able to modify higher privilege users. Authentication is missing on the `setUserInfo` function. Users are advised to update as soon as possible. There are no known workarounds.
- Product
- gin-vue-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 24, 2021Gin-Vue-Admin before 2.4.6 mishandles a SQL database.CVE-2021-44219 · Other software · Gin-vue-admin Project · reported by MITRECritical 9.8
Gin-Vue-Admin before 2.4.6 mishandles a SQL database.
- Product
- Gin-vue-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021vuelidate is vulnerable to Inefficient Regular Expression ComplexityCVE-2021-3794 · Other software · vuelidate · reported by security@huntr.devHigh 7.5
vuelidate is vulnerable to Inefficient Regular Expression Complexity
- Product
- vuelidate/vuelidate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2021GigaVUE-OS (GVOS) 5.4 - 5.9 uses a weak algorithm for a hash stored in internal database.CVE-2020-23250 · Other software · Gigamon · reported by MITRELow 2.3
GigaVUE-OS (GVOS) 5.4 - 5.9 uses a weak algorithm for a hash stored in internal database.
- Product
- Gigavue-os
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.gigamon.comcommunity.gigamon.com
Jan 5, 2021GigaVUE-OS (GVOS) 5.4 - 5.9 stores a Redis database password in plaintext.CVE-2020-23249 · Other software · Gigamon · reported by MITREMedium 4.7
GigaVUE-OS (GVOS) 5.4 - 5.9 stores a Redis database password in plaintext.
- Product
- Gigavue-os
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.gigamon.comcommunity.gigamon.com
Jan 4, 2021The Application Wrapper in Pearson VUE VTS Installer 2.3.1911 has Full Control permissions for Everyone in the "%SYSTEMDRIVE%\Pearson VUE" directory, which alloCVE-2020-36154 · Other software · Pearson · reported by MITREHigh 7.8
The Application Wrapper in Pearson VUE VTS Installer 2.3.1911 has Full Control permissions for Everyone in the "%SYSTEMDRIVE%\Pearson VUE" directory, which allows local users to obtain administrative privileges via a Trojan horse application.
- Product
- VUE Testing System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Oct 12, 2020ARC Informatique PcVue prior to version 12.0.17 is vulnerable to information exposure, allowing unauthorized users to access session data of legitimate users.CVE-2020-26869 · Other software · ARC Informatique · reported by vulnerability@kaspersky.comHigh 7.5
ARC Informatique PcVue prior to version 12.0.17 is vulnerable to information exposure, allowing unauthorized users to access session data of legitimate users. This issue also affects third-party systems based on the Web Services Toolkit.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.kaspersky.comus-cert.cisa.gov
Oct 12, 2020ARC Informatique PcVue prior to version 12.0.17 is vulnerable to a denial-of-service attack due to the ability of an unauthorized user to modify information useCVE-2020-26868 · Other software · ARC Informatique · reported by vulnerability@kaspersky.comHigh 7.5
ARC Informatique PcVue prior to version 12.0.17 is vulnerable to a denial-of-service attack due to the ability of an unauthorized user to modify information used to validate messages sent by legitimate web clients. This issue also affects third-party systems based on the Web Services Toolkit.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.kaspersky.comus-cert.cisa.gov
Oct 12, 2020ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may allow an attacker to remotely execute arbiCVE-2020-26867 · Other software · ARC Informatique · reported by vulnerability@kaspersky.comCritical 9.8
ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.kaspersky.comus-cert.cisa.gov
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.