Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,780 results · page 40 of 76
Mar 30, 2022In DomainVerificationService, there is a possible way to access app domain verification information due to a missing permission check.CVE-2021-39753 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In DomainVerificationService, there is a possible way to access app domain verification information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-200035185
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 25, 2022A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU.CVE-2022-0330 · Computers, phones & browsers · Linux · reported by Red HatHigh 7.8
A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugzilla.redhat.com
Mar 25, 2022Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability via the component /u8sl/WebHelp.CVE-2022-26263 · Other software · Yonyou · reported by MITREMedium 6.1
Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability via the component /u8sl/WebHelp.
- Product
- U8+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2022Beijing Wisdom Vision Technology Industry Co., Ltd One Card Integrated Management System 3.0 is vulnerable to SQL Injection.CVE-2021-44345 · Other software · Wvti · reported by MITREHigh 7.5
Beijing Wisdom Vision Technology Industry Co., Ltd One Card Integrated Management System 3.0 is vulnerable to SQL Injection.
- Product
- ONE Card Integrated Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcnvd.org.cncnvd.org.cn
Mar 16, 2022In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to a race condition.CVE-2021-39686 · Computers, phones & browsers · Google · reported by security@android.comHigh 7
In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-200688826References: Upstream kernel
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 15, 2022Mimecast Email Security before 2020-01-10 allows any admin to spoof any domain, and pass DMARC alignment via SPF.CVE-2020-36519 · Other software · Mimecast · reported by MITREMedium 4.9
Mimecast Email Security before 2020-01-10 allows any admin to spoof any domain, and pass DMARC alignment via SPF. This occurs through misuse of the address rewrite feature. (The domain being spoofed must be a customer in the Mimecast grid from which the spoofing occurs.)
- Product
- Email Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens.CVE-2022-26779 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project invite is created based only on an email address, a random token is generated. An attacker with knowledge of the project ID and the fact that the invite is sent, could generate time deterministic tokens and brute force attempt to use them prior to the legitimate receiver accepting the invite. This feature is not enabled by default, the attacker is required to know or guess the project ID for the invite in addition to the invitation token, and the attacker would need to be an existing authorized user of CloudStack.
- Product
- Apache CloudStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Mar 14, 2022A carefully crafted request body can cause a read to a random memory area which could cause the process to crash.CVE-2022-22719 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.
- Product
- Apache HTTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Mar 10, 2022Simple Diagnostics Agent - versions 1.0 (up to version 1.57.), allows an attacker to access information which would otherwise be restricted via a random port 90CVE-2022-22547 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.5
Simple Diagnostics Agent - versions 1.0 (up to version 1.57.), allows an attacker to access information which would otherwise be restricted via a random port 9000-65535. This allows information gathering which could be used exploit future open-source security exploits.
- Product
- Simple Diagnostics Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Mar 10, 2022An arbitrary code execution vulnerability was found in the F-Secure Support Tool.CVE-2021-44750 · Other software · F-Secure · reported by cve-notifications-us@f-secure.comMedium 6.4
An arbitrary code execution vulnerability was found in the F-Secure Support Tool. A standard user can craft a special configuration file, which when run by administrator can execute any commands.
- Product
- F-Secure Elements Agent, F-Secure MDR, F-Secure Client Security, F-Secure Server Security, F-Secure Email and Server Security, F-Secure Freedome VPN, F-Secure S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordf-secure.comf-secure.com
Mar 4, 2022Mark Text v0.16.3 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability which allows attackers to perform remote code execution (RCE) vCVE-2022-25069 · Other software · Marktext · reported by MITRECritical 9.6
Mark Text v0.16.3 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability which allows attackers to perform remote code execution (RCE) via injecting a crafted payload into /lib/contentState/pasteCtrl.js.
- Product
- Marktext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2022jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).CVE-2022-23395 · Other software · Jquery.cookie Project · reported by MITREMedium 6.1
jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).
- Product
- Jquery.cookie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comsnyk.io
Mar 1, 2022The use of a cryptographically weak pseudo-random number generator in the password reset feature of FortiPortal before 6.0.6 may allow a remote unauthenticated CVE-2021-36171 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 8.1
The use of a cryptographically weak pseudo-random number generator in the password reset feature of FortiPortal before 6.0.6 may allow a remote unauthenticated attacker to predict parts of or the whole newly generated password within a given time frame.
- Product
- Fortinet FortiPortal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Mar 1, 2022Cross-site Scripting (XSS) - DOM in GitHub repository hakimel/reveal.js prior to 4.3.0.CVE-2022-0776 · Other software · hakimel · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - DOM in GitHub repository hakimel/reveal.js prior to 4.3.0.
- Product
- hakimel/reveal.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022Due to usernames/passwords being stored in plaintext in Random Access Memory (RAM), a local, authenticated attacker could gain access to certain credentials, inCVE-2020-14480 · Other software · Rockwell Automation · reported by ics-cert@hq.dhs.govMedium 5.5
Due to usernames/passwords being stored in plaintext in Random Access Memory (RAM), a local, authenticated attacker could gain access to certain credentials, including Windows Logon credentials.
- Product
- FactoryTalk View SE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2022A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts.CVE-2022-0564 · Other software · Qlik Sense · reported by csirt@divd.nlMedium 5.3
A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time that are returned by the affected system to determine which accounts are valid user accounts. Affected systems are only vulnerable if they have LDAP configured. The affected URI is /internal_forms_authentication/ the response time of the form is longer if the supplied user does not exists and shorter if the user exists.
- Product
- Qlik Sense Enterprise on Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.qlik.comcsirt.divd.nl
Feb 18, 2022A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication.CVE-2020-25719 · Other software · Samba · reported by Red HatHigh 7.2
A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise.
- Product
- Samba
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comsecurity.gentoo.org
Feb 18, 2022A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller).CVE-2020-25718 · Other software · Samba · reported by Red HatHigh 8.8
A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This would allow an RODC to print administrator tickets.
- Product
- Samba
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comsecurity.gentoo.org
Feb 18, 2022A flaw was found in the way Samba maps domain users to local users.CVE-2020-25717 · Other software · Samba · reported by Red HatHigh 8.1
A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation.
- Product
- Samba
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comsecurity.gentoo.org
Feb 14, 2022Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in language_general.class.php via doModifyParameter.CVE-2022-23335 · Other software · Metinfo · reported by MITRECritical 9.8
Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in language_general.class.php via doModifyParameter.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.youdao.comnote.youdao.com
Feb 14, 2022Fulusso v1.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in /BindAccount/SuccessTips.js.CVE-2022-23367 · Other software · Fulusso Project · reported by MITREMedium 6.1
Fulusso v1.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in /BindAccount/SuccessTips.js. This vulnerability allows attackers to inject malicious code into a victim user's device via open redirection.
- Product
- Fulusso
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Feb 9, 2022A CWE-352: Cross-Site Request Forgery (CSRF) exists that could cause a remote attacker to gain unauthorized access to the product when conducting cross-domain aCVE-2022-22808 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 8.8
A CWE-352: Cross-Site Request Forgery (CSRF) exists that could cause a remote attacker to gain unauthorized access to the product when conducting cross-domain attacks based on same-origin policy or cross-site request forgery protections bypass. Affected Product: EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System): (HMIBSCEA53D1EDB, HMIBSCEA53D1EDS, HMIBSCEA53D1EDM, HMIBSCEA53D1EDL, HMIBSCEA53D1ESS, HMIBSCEA53D1ESM, HMIBSCEA53D1EML) (All Versions prior to SP8 (Version 01) V4.0.0.13)
- Product
- Hmibscea53d1edb Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Feb 7, 2022SEUR Oficial: Creates a PHP file with a random nameCVE-2021-25004 · WordPress plugins & themes · reported by WPScanMedium 4.9
The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is used for support purposes, it allows to download any file from the web server without restriction after knowing the URL and a password than an administrator can see in the plugin settings page.
- Product
- SEUR Oficial
- Fixed in
- 1.7.2
- What to do
- Update SEUR Oficial to 1.7.2 or newer.
Feb 4, 2022Cross-site Scripting (XSS) - DOM in NPM karma prior to 6.3.14.CVE-2022-0437 · Other software · karma-runner · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - DOM in NPM karma prior to 6.3.14.
- Product
- karma-runner/karma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2022Domain Check: Does not sanitise and escape the domain parameter before outputting it back in the pageCVE-2021-24926 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Domain Check WordPress plugin before 1.0.17 does not sanitise and escape the domain parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue
- Product
- Domain Check
- Fixed in
- 1.0.17
- What to do
- Update Domain Check to 1.0.17 or newer.
Jan 25, 2022On BIG-IP DNS & GTM version 16.x before 16.1.0, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, a DOM-based cross-CVE-2022-23013 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.8
On BIG-IP DNS & GTM version 16.x before 16.1.0, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, a DOM-based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- Big-ip Domain Name System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comsupport.f5.com
Jan 20, 2022Telenot CompasX versions prior to 32.0 use a weak seed for random number generation leading to predictable AES keys used in the NFC tags used for local authorizCVE-2021-34600 · Other software · Telenot Electronic GmbH · reported by info@cert.vde.comMedium 5.5
Telenot CompasX versions prior to 32.0 use a weak seed for random number generation leading to predictable AES keys used in the NFC tags used for local authorization of users. This may lead to total loss of trustworthiness of the installation.
- Product
- CompasX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordx41-dsec.dex41-dsec.de
Jan 18, 2022wolfSSL 5.x before 5.1.1 uses non-random IV values in certain situations.CVE-2022-23408 · Other software · Wolfssl · reported by MITRECritical 9.1
wolfSSL 5.x before 5.1.1 uses non-random IV values in certain situations. This affects connections (without AEAD) using AES-CBC or DES3 with TLS 1.1 or 1.2 or DTLS 1.1 or 1.2. This occurs because of misplaced memory initialization in BuildMessage in internal.c.
- Product
- Wolfssl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022Random Banner: Stored Cross-Site ScriptingCVE-2022-0210 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Random Banner WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the category parameter found in the ~/include/models/model.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 4.1.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- Random Banner
- Affected
- up to 4.1.4
- What to do
- Affects up to 4.1.4. Update Random Banner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Jan 18, 2022A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() sCVE-2021-4083 · Computers, phones & browsers · Linux · reported by Red HatHigh 7
A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalate their privileges on the system. This flaw affects Linux kernel versions prior to 5.16-rc4.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgit.kernel.org
Jan 14, 2022Incorrect download source UI in Downloads in Samsung Internet prior to 16.0.6.23 allows attackers to perform domain spoofing via a crafted HTML page.CVE-2022-22290 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.5
Incorrect download source UI in Downloads in Samsung Internet prior to 16.0.6.23 allows attackers to perform domain spoofing via a crafted HTML page.
- Product
- Samsung Internet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jan 14, 2022A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) and Cisco Unified Contact Center Domain MCVE-2022-20658 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.6
A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) and Cisco Unified Contact Center Domain Manager (Unified CCDM) could allow an authenticated, remote attacker to elevate their privileges to Administrator. This vulnerability is due to the lack of server-side validation of user permissions. An attacker could exploit this vulnerability by submitting a crafted HTTP request to a vulnerable system. A successful exploit could allow the attacker to create Administrator accounts. With these accounts, the attacker could access and modify telephony and user resources across all the Unified platforms that are associated to the vulnerable Cisco Unified CCMP. To successfully exploit this vulnerability, an attacker would need valid Advanced User credentials.
- Product
- Cisco Unified Contact Center Domain Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Jan 11, 2022Local Security Authority (Domain Policy) Remote Protocol Security Feature BypassCVE-2022-21913 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.3
Local Security Authority (Domain Policy) Remote Protocol Security Feature Bypass
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 11, 2022Active Directory Domain Services Elevation of Privilege VulnerabilityCVE-2022-21857 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Active Directory Domain Services Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 10, 2022Z-Wave devices based on Silicon Labs 500 series chipsets using CRC-16 encapsulation, including but likely not limited to the Linear LB60Z-1 version 3.5, Dome DMCVE-2020-9058 · Other software · Linear · reported by cret@cert.orgHigh 8.1
Z-Wave devices based on Silicon Labs 500 series chipsets using CRC-16 encapsulation, including but likely not limited to the Linear LB60Z-1 version 3.5, Dome DM501 version 4.26, and Jasco ZW4201 version 4.05, do not implement encryption or replay protection.
- Product
- LB60Z-1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2022A DOM-based cross-site scripting (XSS) vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3 CVE-2020-27428 · Other software · MIT · reported by MITREMedium 6.1
A DOM-based cross-site scripting (XSS) vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3 file.
- Product
- Scratch-svg-renderer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2022ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on tCVE-2021-20148 · Email & office · Zohocorp · reported by vulnreport@tenable.comMedium 4.3
ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name. When ADSSP is configured with multiple Windows domains, a user from one domain can obtain the password policy for another domain by authenticating to the service and then sending a request specifying the password policy file of the other domain.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Jan 3, 2022Possible out of bound read due to lack of domain input validation while processing APK close session request in Snapdragon Auto, Snapdragon Compute, Snapdragon CVE-2021-30336 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.4
Possible out of bound read due to lack of domain input validation while processing APK close session request in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Wearables
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Wearables
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Dec 27, 2021Simple JWT Login: Can be used to create new WordPress user accounts with a randomly generated passwordCVE-2021-24998 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the str_shuffle PHP function that "does not generate cryptographically secure values, and should not be used for cryptographic purposes" according to PHP's documentation.
- Product
- Simple JWT Login
- Fixed in
- 3.3.0
- What to do
- Update Simple JWT Login to 3.3.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 22, 2021Incorrect security UI in autofill in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to perform domain spoofing via a crafted HTML page.CVE-2021-4054 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Incorrect security UI in autofill in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Dec 22, 2021Inappropriate implementation in navigation in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to perform domain spoofing via a crafted HTML page.CVE-2021-38018 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Inappropriate implementation in navigation in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Dec 15, 2021An issue in /domain/service/.ewell-known/caldav of Zimbra Collaboration 8.8.12 allows attackers to redirect users to any arbitrary website of their choosing.CVE-2020-18985 · Email & office · Synacor · reported by MITREMedium 6.1
An issue in /domain/service/.ewell-known/caldav of Zimbra Collaboration 8.8.12 allows attackers to redirect users to any arbitrary website of their choosing.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2021When parsing internationalized domain names, high bits of the characters in the URLs were sometimes stripped, resulting in inconsistencies that could lead to usCVE-2021-43533 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
When parsing internationalized domain names, high bits of the characters in the URLs were sometimes stripped, resulting in inconsistencies that could lead to user confusion or attacks such as phishing. This vulnerability affects Firefox < 94.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 7, 2021In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter mCVE-2021-36760 · Other software · Wso2 · reported by MITREMedium 6.1
In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL that precedes the callback parameter. Once the username or password reset procedure is completed, the JavaScript code will be executed. (recoverpassword.do also has an open redirect issue for a similar reason.)
- Product
- API Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.wso2.comdocs.wso2.com
Dec 7, 2021A DOM-based XSS vulnerability affects SquaredUp for SCOM 5.2.1.6654.CVE-2021-40094 · Other software · Squaredup · reported by MITREMedium 5.4
A DOM-based XSS vulnerability affects SquaredUp for SCOM 5.2.1.6654. If successfully exploited, this vulnerability may allow attackers to inject malicious code into a user's device.
- Product
- Squaredup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.squaredup.comsupport.squaredup.com
Dec 1, 2021showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)CVE-2021-3990 · Other software · star7th · reported by security@huntr.devMedium 6.5
showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
- Product
- star7th/showdoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2021tripexpress v1.1 is affected by a path manipulation vulnerability in file system/helpers/dompdf/load_font.php.CVE-2021-43691 · Other software · Tripexpress Project · reported by MITRECritical 9.8
tripexpress v1.1 is affected by a path manipulation vulnerability in file system/helpers/dompdf/load_font.php. The variable src is coming from $_SERVER["argv"] then there is a path manipulation vulnerability.
- Product
- Tripexpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2021Elementor Website Builder: Does not sanitise or escape user input appended to the DOM via a malicious hashCVE-2021-24891 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Elementor Website Builder WordPress plugin before 3.4.8 does not sanitise or escape user input appended to the DOM via a malicious hash, resulting in a DOM Cross-Site Scripting issue.
- Product
- Elementor Website Builder
- Fixed in
- 3.4.8
- What to do
- Update Elementor Website Builder to 3.4.8 or newer.
Full record and what to do →NVD recordwpscan.comjbelamor.com
Nov 23, 2021A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnCVE-2021-3672 · Other software · C-ares Project · reported by Red HatMedium 5.6
A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.
- Product
- C-ares
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comc-ares.haxx.se
Nov 16, 2021Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”.CVE-2021-26322 · Other software · AMD · reported by psirt@amd.comHigh 7.5
Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”.
- Product
- 1st Gen AMD EPYC™
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.