Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,792 results · page 40 of 76
Sep 9, 2022Use after free vulnerability in mtp_send_signal function of MTP driver prior to SMR Sep-2022 Release 1 allows attackers to perform malicious actions.CVE-2022-36847 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.9
Use after free vulnerability in mtp_send_signal function of MTP driver prior to SMR Sep-2022 Release 1 allows attackers to perform malicious actions.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Sep 7, 2022Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers V3.0.1.17 were discovered to contain a remote command execution (RCE) vulnerability via the sendnCVE-2022-37779 · Other software · Phicomm · reported by MITREHigh 7.2
Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers V3.0.1.17 were discovered to contain a remote command execution (RCE) vulnerability via the sendnum parameter of the ping function.
- Product
- Fir151b Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2022Buffer Overflow in Netgear R8000 Router with firmware v1.0.4.56 allows remote attackers to execute arbitrary code or cause a denial-of-service by sending a crafCVE-2021-34236 · Network & remote access · Netgear · reported by MITRECritical 9.8
Buffer Overflow in Netgear R8000 Router with firmware v1.0.4.56 allows remote attackers to execute arbitrary code or cause a denial-of-service by sending a crafted POST to '/bd_genie_create_account.cgi' with a sufficiently long parameter 'register_country'.
- Product
- R8000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2022WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to retrieve sensitive authentication server settings by sending a malicious requeCVE-2022-31790 · Network & remote access · Watchguard · reported by MITREHigh 7.5
WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to retrieve sensitive authentication server settings by sending a malicious request to exposed authentication endpoints. This is fixed in Fireware OS 12.8.1, 12.5.10, and 12.1.4.
- Product
- Fireware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordambionics.ioopenwall.com
Sep 2, 2022Discourse through 2.8.7 allows admins to send invitations to arbitrary email addresses at an unlimited rate.CVE-2022-37458 · Other software · Discourse · reported by MITREHigh 7.2
Discourse through 2.8.7 allows admins to send invitations to arbitrary email addresses at an unlimited rate.
- Product
- Discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2022wolfSSL through 5.0.0 allows an attacker to cause a denial of service and infinite loop in the client component by sending crafted traffic from a Machine-in-theCVE-2021-44718 · Other software · Wolfssl · reported by MITREMedium 5.9
wolfSSL through 5.0.0 allows an attacker to cause a denial of service and infinite loop in the client component by sending crafted traffic from a Machine-in-the-Middle (MITM) position. The root cause is that the client module accepts TLS messages that normally are only sent to TLS servers.
- Product
- Wolfssl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2022IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to a denial of service via email flooding caused by sending a specially-crafted request.CVE-2022-30614 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to a denial of service via email flooding caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume all available CPU resources. IBM X-Force ID: 227591.
- Product
- Cognos Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comsecurity.netapp.com
Aug 30, 2022An attacker can send malicious RTMP requests to make the ZLMediaKit server crash remotely.CVE-2022-37237 · Other software · Zlmediakit · reported by MITREHigh 7.5
An attacker can send malicious RTMP requests to make the ZLMediaKit server crash remotely. Affected version is below commit 7d8b212a3c3368bc2f6507cb74664fc419eb9327.
- Product
- Zlmediakit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2022Sensei LMS: Does not ensure that the sender of a private message is either the teacher or the original senderCVE-2022-2080 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original sender, allowing any authenticated user to send messages to arbitrary private conversation via a IDOR attack. Note: Attackers are not able to see responses/messages between the teacher and student
- Product
- Sensei LMS
- Fixed in
- 4.5.2
- What to do
- Update Sensei LMS to 4.5.2 or newer.
Full record and what to do →NVD recordhackerone.comwpscan.com
Aug 24, 2022This issue was addressed by using HTTPS when sending information over the network.CVE-2022-32857 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina, iOS 15.6 and iPadOS 15.6, tvOS 15.6, watchOS 8.7. A user in a privileged network position can track a user’s activity.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Aug 24, 2022The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multipCVE-2022-24375 · Other software · Node-opcua Project · reported by report@snyk.ioHigh 7.5
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.
- Product
- Node-opcua
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2022The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) by sending a specifically crafted OPC UA message with a special OPC UA NodeID, whCVE-2022-25231 · Other software · Node-opcua Project · reported by report@snyk.ioHigh 7.5
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) by sending a specifically crafted OPC UA message with a special OPC UA NodeID, when the requested memory allocation exceeds the v8’s memory limit.
- Product
- Node-opcua
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2022All versions of package freeopcua/freeopcua are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sendingCVE-2022-24298 · Other software · Freeopcua · reported by report@snyk.ioHigh 7.5
All versions of package freeopcua/freeopcua are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.
- Product
- Freeopcua
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.snyk.io
Aug 22, 2022Tabit - arbitrary SMS send on Tabits behalf.CVE-2022-34771 · Other software · Tabit · reported by cna@cyber.gov.ilMedium 5.5
Tabit - arbitrary SMS send on Tabits behalf. The resend OTP API of tabit allows an adversary to send messages on tabits behalf to anyone registered on the system - the API receives the parameters: phone number, and CustomMessage, We can use that API to craft malicious messages to any user of the system. In addition, the API probably has some kind of template injection potential. When entering {{OTP}} in the custom message field it is formatted into an OTP.
- Product
- Tabit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022FusionPBX 5.0.1 was discovered to contain a command injection vulnerability via /fax/fax_send.php.CVE-2022-35153 · Other software · Fusionpbx · reported by MITRECritical 9.8
FusionPBX 5.0.1 was discovered to contain a command injection vulnerability via /fax/fax_send.php.
- Product
- Fusionpbx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2022This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS.CVE-2022-23765 · Other software · EFM Networks Co.,Ltd · reported by vuln@krcert.or.krHigh 8
This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS. Remote attackers can steal root privileges by changing the password of the root through a POST request.
- Product
- NAS1dual, NAS2dual, NAS4dual
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Aug 15, 2022In Nordic nRF5 SDK for Mesh 5.0, a heap overflow vulnerability can be triggered by sending a series of segmented packets with SegO > SegNCVE-2022-35624 · Other software · Nordicsemi · reported by MITREHigh 8.2
In Nordic nRF5 SDK for Mesh 5.0, a heap overflow vulnerability can be triggered by sending a series of segmented packets with SegO > SegN
- Product
- Nrf5 SDK For Mesh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comdocs.google.com
Aug 15, 2022In Nordic nRF5 SDK for Mesh 5.0, a heap overflow vulnerability can be triggered by sending a series of segmented control packets and access packets with the samCVE-2022-35623 · Other software · Nordicsemi · reported by MITREHigh 8.2
In Nordic nRF5 SDK for Mesh 5.0, a heap overflow vulnerability can be triggered by sending a series of segmented control packets and access packets with the same SeqAuth
- Product
- Nrf5 SDK For Mesh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comdocs.google.com
Aug 15, 2022dproxy-nexgen (aka dproxy nexgen) re-uses the DNS transaction id (TXID) value from client queries, which allows attackers (able to send queries to the resolver)CVE-2022-33988 · Other software · Dproxy-nexgen Project · reported by MITREHigh 7.5
dproxy-nexgen (aka dproxy nexgen) re-uses the DNS transaction id (TXID) value from client queries, which allows attackers (able to send queries to the resolver) to conduct DNS cache-poisoning attacks because the TXID value is known to the attacker.
- Product
- Dproxy-nexgen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netopenwall.com
Aug 12, 2022In RestrictionsManager, there is a possible way to send a broadcast that should be restricted to system apps due to a permissions bypass.CVE-2022-20268 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In RestrictionsManager, there is a possible way to send a broadcast that should be restricted to system apps due to a permissions bypass. This could lead to local escalation of privilege on an enterprise managed device with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-210468836
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Aug 10, 2022Improper Input Validation vulnerability in HTTP/1.1 header parsing of Apache Traffic Server allows an attacker to send invalid headers.CVE-2022-28129 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Improper Input Validation vulnerability in HTTP/1.1 header parsing of Apache Traffic Server allows an attacker to send invalid headers. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
- Product
- Apache Traffic Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.debian.org
Aug 8, 2022In Zammad 5.2.0, an attacker could manipulate the rate limiting in the 'forgot password' feature of Zammad, and thereby send many requests for a known account tCVE-2022-35488 · Other software · Zammad · reported by MITREHigh 7.5
In Zammad 5.2.0, an attacker could manipulate the rate limiting in the 'forgot password' feature of Zammad, and thereby send many requests for a known account to cause Denial Of Service by many generated emails which would also spam the victim.
- Product
- Zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2022Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set.CVE-2022-37452 · Other software · Exim · reported by MITRECritical 9.8
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set.
- Product
- Exim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2022A segmentation fault in TripleCross v0.1.0 occurs when sending a control command from the client to the server.CVE-2022-35505 · Other software · Triplecross Project · reported by MITREHigh 7.5
A segmentation fault in TripleCross v0.1.0 occurs when sending a control command from the client to the server. This occurs because there is no limit to the length of the output of the executed command.
- Product
- Triplecross
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2022In ConnMan through 1.41, remote attackers able to send HTTP requests to the gweb component are able to exploit a heap-based buffer overflow in received_data to CVE-2022-32292 · Other software · Intel · reported by MITRECritical 9.8
In ConnMan through 1.41, remote attackers able to send HTTP requests to the gweb component are able to exploit a heap-based buffer overflow in received_data to execute code.
- Product
- Connman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comlore.kernel.org
Jul 27, 2022In Veritas NetBackup, an attacker with unprivileged local access to a NetBackup Client may send specific commands to escalate their privileges.CVE-2022-36955 · Other software · Veritas · reported by MITREHigh 7.8
In Veritas NetBackup, an attacker with unprivileged local access to a NetBackup Client may send specific commands to escalate their privileges. This affects 8.0 through 8.1.2, 8.2, 8.3 through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1.
- Product
- Netbackup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordveritas.comveritas.com
Jul 22, 2022Insufficient validation of trust input in WebOTP in Google Chrome on Android prior to 100.0.4896.60 allowed a remote attacker to send arbitrary intents from anyCVE-2022-1130 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.1
Insufficient validation of trust input in WebOTP in Google Chrome on Android prior to 100.0.4896.60 allowed a remote attacker to send arbitrary intents from any app via a malicious app.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Jul 22, 2022The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload.CVE-2022-25759 · Other software · Convert-svg-core Project · reported by report@snyk.ioCritical 9.9
The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload.
- Product
- Convert-svg-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2022A remote attacker with general user privilege can send a message to Teamplus Pro’s chat group that exceeds message size limit, to terminate other recipients’ TeCVE-2022-32958 · Other software · TEAMPLUS TECHNOLOGY INC. · reported by twcert@cert.org.twHigh 7.7
A remote attacker with general user privilege can send a message to Teamplus Pro’s chat group that exceeds message size limit, to terminate other recipients’ Teamplus Pro chat process.
- Product
- Teamplus Pro (Private cloud)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jul 18, 2022When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds.CVE-2021-33655 · Other software · Siemens · reported by securities@openeuler.orgMedium 6.7
When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds.
- Product
- SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgit.kernel.org
Jul 13, 2022Cross Site Scripting (XSS) vulnerability in uBlock Origin extension before 1.41.1 allows remote attackers to run arbitrary code via a spoofed 'MessageSender.urlCVE-2022-32308 · Other software · Ublock Origin Project · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in uBlock Origin extension before 1.41.1 allows remote attackers to run arbitrary code via a spoofed 'MessageSender.url' to the browser renderer process.
- Product
- Ublock Origin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022Due to missing authentication check, SAP Business one License service API - version 10.0 allows an unauthenticated attacker to send malicious http requests overCVE-2022-28771 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.5
Due to missing authentication check, SAP Business one License service API - version 10.0 allows an unauthenticated attacker to send malicious http requests over the network. On successful exploitation, an attacker can break the whole application making it inaccessible.
- Product
- SAP Business One License service API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Jul 12, 2022Improper access control vulnerability in sendDHCPACKBroadcast function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows attacker to access wifi ap clieCVE-2022-30752 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.3
Improper access control vulnerability in sendDHCPACKBroadcast function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows attacker to access wifi ap client mac address that connected by using WIFI_AP_STA_STATE_CHANGED action.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jul 12, 2022Improper access control vulnerability in sendDHCPACKBroadcast function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows attacker to access wifi ap clieCVE-2022-30751 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.3
Improper access control vulnerability in sendDHCPACKBroadcast function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows attacker to access wifi ap client mac address that connected by using WIFI_AP_STA_DHCPACK_EVENT action.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jul 10, 2022The zippies/testplatform repository through 2016-07-19 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31588 · Other software · Testplatform Project · reported by MITRECritical 9.3
The zippies/testplatform repository through 2016-07-19 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Testplatform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The yuriyouzhou/KG-fashion-chatbot repository through 2018-05-22 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31587 · Other software · Kg-fashion-chatbot Project · reported by MITRECritical 9.3
The yuriyouzhou/KG-fashion-chatbot repository through 2018-05-22 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Kg-fashion-chatbot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The unizar-30226-2019-06/ChangePop-Back repository through 2019-06-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsaCVE-2022-31586 · Other software · Changepop-back Project · reported by MITRECritical 9.3
The unizar-30226-2019-06/ChangePop-Back repository through 2019-06-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Changepop-back
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The umeshpatil-dev/Home__internet repository through 2020-08-28 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31585 · Other software · Home Internet Project · reported by MITRECritical 9.3
The umeshpatil-dev/Home__internet repository through 2020-08-28 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Home Internet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The stonethree/s3label repository through 2019-08-14 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31584 · Other software · S3label Project · reported by MITRECritical 9.3
The stonethree/s3label repository through 2019-08-14 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- S3label
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The sravaniboinepelli/AutomatedQuizEval repository through 2020-04-27 on GitHub allows absolute path traversal because the Flask send_file function is used unsaCVE-2022-31583 · Other software · Automatedquizeval Project · reported by MITRECritical 9.3
The sravaniboinepelli/AutomatedQuizEval repository through 2020-04-27 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Automatedquizeval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The shaolo1/VideoServer repository through 2019-09-21 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31582 · Other software · Videoserver Project · reported by MITRECritical 9.3
The shaolo1/VideoServer repository through 2019-09-21 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Videoserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The scorelab/OpenMF repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31581 · Other software · Scorelab · reported by MITRECritical 9.3
The scorelab/OpenMF repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Openmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The sanojtharindu/caretakerr-api repository through 2021-05-17 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31580 · Other software · Caretakerr-api Project · reported by MITRECritical 9.3
The sanojtharindu/caretakerr-api repository through 2021-05-17 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Caretakerr-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The ralphjzhang/iasset repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31579 · Other software · Iasset Project · reported by MITRECritical 9.3
The ralphjzhang/iasset repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Iasset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The piaoyunsoft/bt_lnmp repository through 2019-10-10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31578 · Other software · BT Lnmp Project · reported by MITREHigh 7.5
The piaoyunsoft/bt_lnmp repository through 2019-10-10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- BT Lnmp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The longmaoteamtf/audio_aligner_app repository through 2020-01-10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafelyCVE-2022-31577 · Other software · Audio Aligner App Project · reported by MITRECritical 9.3
The longmaoteamtf/audio_aligner_app repository through 2020-01-10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Audio Aligner App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The heidi-luong1109/shackerpanel repository through 2021-05-25 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31576 · Other software · Shackerpanel Project · reported by MITRECritical 9.3
The heidi-luong1109/shackerpanel repository through 2021-05-25 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Shackerpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The duducosmos/livro_python repository through 2018-06-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31575 · Other software · Livro Python Project · reported by MITRECritical 9.3
The duducosmos/livro_python repository through 2018-06-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Livro Python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The deepaliupadhyay/RealEstate repository through 2018-11-30 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31574 · Other software · Realestate Project · reported by MITRECritical 9.3
The deepaliupadhyay/RealEstate repository through 2018-11-30 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Realestate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The chainer/chainerrl-visualizer repository through 0.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31573 · Other software · Chainer · reported by MITRECritical 9.3
The chainer/chainerrl-visualizer repository through 0.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Chainerrl-visualizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.