Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,401 results · page 41 of 69
Jun 6, 2023Kali Forms: Authenticated Options ChangeCVE-2020-36720 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Kali Forms plugin for WordPress is vulnerable to Authenticated Options Change in versions up to, and including, 2.1.1. This is due to the update_option lacking proper authentication checks. This makes it possible for any authenticated attacker to change (or delete) the plugin's settings.
- Product
- Kali Forms
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordpress.org
Jun 6, 2023Kali Forms: Cross-Site Request ForgeryCVE-2020-36717 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Kali Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.1. This is due to incorrect nonce handling throughout the plugin's function. This makes it possible for unauthenticated attackers to access the plugin's administrative functions via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Kali Forms
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
Jun 6, 2023Kali Forms: Unauthenticated Arbitrary Post DeletionCVE-2020-36712 · WordPress plugins & themes · reported by WordfenceHigh 8.6
The Kali Forms plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 2.1.1. This is due to the kaliforms_form_delete_uploaded_file function lacking any privilege or user protections. This makes it possible for unauthenticated attackers to delete any site post or page with the id parameter.
- Product
- Kali Forms
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
Jun 6, 2023Contact Form & SMTP Plugin by PirateForms: HTML injection in the ‘public/class-pirateforms-publicCVE-2019-25145 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Contact Form & SMTP Plugin by PirateForms plugin for WordPress is vulnerable to HTML injection in the ‘public/class-pirateforms-public.php’ file in versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary HTML in emails that could be used to phish unsuspecting victims.
- Product
- Contact Form & SMTP Plugin by PirateForms
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Contact Form & SMTP Plugin by PirateForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
Jun 5, 2023A vulnerability, which was classified as problematic, was found in Gravity Forms DPS PxPay Plugin up to 1.4.2 on WordPress.CVE-2015-10117 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in Gravity Forms DPS PxPay Plugin up to 1.4.2 on WordPress. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.4.3 is able to address this issue. The name of the patch is 5966a5e6343e3d5610bdfa126a5cfbae95e629b6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230664.
- Product
- Gravity Forms DPS PxPay
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Gravity Forms DPS PxPay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2023On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart.CVE-2023-24510 · Other software · Arista Networks · reported by psirt@arista.comHigh 7.5
On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart.
- Product
- Arista EOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2023Advent/SSC Inc.CVE-2023-33524 · Other software · Advent · reported by MITREMedium 5.3
Advent/SSC Inc. Tamale RMS < 23.1 is vulnerable to Directory Traversal. If one traverses to the affected URL, one enumerates Contact information on the host which contains usernames, e-mail addresses, and other internal information stored within the web app.
- Product
- Tamale RMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.reportgist.github.com
Jun 5, 2023Stop Spammers Security | Block Spam Users, Comments, Forms: Does not sanitise and escape some of its settingsCVE-2023-2489 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Stop Spammers Security | Block Spam Users, Comments, Forms
- Fixed in
- 2023
- What to do
- Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2023 or newer.
Jun 5, 2023Stop Spammers Security | Block Spam Users, Comments, Forms: Does not sanitise and escape various parameters before outputting them back in admin dashboard pagesCVE-2023-2488 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape various parameters before outputting them back in admin dashboard pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Stop Spammers Security | Block Spam Users, Comments, Forms
- Fixed in
- 2023
- What to do
- Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2023 or newer.
Jun 5, 2023Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Does not sanitise and escape a parameter before outputting it back in the admin dashboardCVE-2023-2472 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.61 does not sanitise and escape a parameter before outputting it back in the admin dashboard when the WPML plugin is also active and configured, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
- Fixed in
- 3.1.61
- What to do
- Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to 3.1.61 or newer.
Jun 2, 2023Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the firewallEn parameter in the formSetFirewallCfg function.CVE-2023-33673 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the firewallEn parameter in the formSetFirewallCfg function.
- Product
- Ac8 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023Formcreator is a GLPI plugin which allow creation of custom forms and the creation of one or more tickets when the form is filled.CVE-2023-33971 · Other software · pluginsGLPI · reported by GitHubMedium 6.1
Formcreator is a GLPI plugin which allow creation of custom forms and the creation of one or more tickets when the form is filled. A probable stored cross-site scripting vulnerability is present in Formcreator 2.13.5 and prior via the use of the use of `##FULLFORM##` for rendering. This could result in arbitrary javascript code execution in an admin/tech context. A patch is unavailable as of time of publication. As a workaround, one may use a regular expression to remove `< > "` in all fields.
- Product
- formcreator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023CRM Perks Forms: Stored Cross-Site ScriptingCVE-2023-2836 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The CRM Perks Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- CRM Perks Forms
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update CRM Perks Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
May 30, 2023Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control that allows an authenticated user can update global parameters.CVE-2023-23562 · Other software · Stormshield · reported by MITREMedium 4.3
Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control that allows an authenticated user can update global parameters.
- Product
- Endpoint Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.stormshield.euadvisories.stormshield.eu
May 30, 2023Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control: authenticated users can read sensitive information.CVE-2023-23561 · Other software · Stormshield · reported by MITREMedium 5.5
Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control: authenticated users can read sensitive information.
- Product
- Endpoint Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.stormshield.euadvisories.stormshield.eu
May 30, 2023Easy Forms for Mailchimp: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2518 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape a parameter before outputting it back in the page when the debug option is enabled, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Easy Forms for Mailchimp
- Fixed in
- 6.8.9
- What to do
- Update Easy Forms for Mailchimp to 6.8.9 or newer.
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in chronoengine.Com Chronoforms plugin <= 7.0.9 versions.CVE-2022-47135 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in chronoengine.Com Chronoforms plugin <= 7.0.9 versions.
- Affected
- up to 7.0.9
- What to do
- Affects up to 7.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 22, 2023Directory traversal vulnerability in Snow Monkey Forms versions v5.0.6 and earlier allows a remote unauthenticated attacker to obtain sensitive information, altCVE-2023-28413 · Other software · Monkey Wrench Inc. · reported by vultures@jpcert.or.jpCritical 9.8
Directory traversal vulnerability in Snow Monkey Forms versions v5.0.6 and earlier allows a remote unauthenticated attacker to obtain sensitive information, alter the website, or cause a denial-of-service (DoS) condition.
- Product
- Snow Monkey Forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsnow-monkey.2inc.org
May 22, 2023 Teltonika’s Remote Management System versions 4.14.0 is vulnerable to an unauthorized attacker registering previously unregistered devices through the RMS platCVE-2023-2586 · Other software · Teltonika · reported by ics-cert@hq.dhs.govCritical 9
Teltonika’s Remote Management System versions 4.14.0 is vulnerable to an unauthorized attacker registering previously unregistered devices through the RMS platform. If the user has not disabled the "RMS management feature" enabled by default, then an attacker could register that device to themselves. This could enable the attacker to perform different operations on the user's devices, including remote code execution with 'root' privileges (using the 'Task Manager' feature on RMS).
- Product
- Remote Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023OTP Login Woocommerce & Gravity Forms: Authentication bypassCVE-2023-2706 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via phone number, the plugin returns these codes in an AJAX response. This makes it possible for unauthenticated attackers to obtain login codes for administrators. This does require an attacker have access to the phone number configured for an account, which can be obtained via social engineering or reconnaissance.
- Product
- OTP Login Woocommerce & Gravity Forms
- Fixed in
- 2.3
- What to do
- Update OTP Login Woocommerce & Gravity Forms to 2.3 or newer.
Full record and what to do →NVD recordlana.codesplugins.trac.wordpress.org
May 15, 2023Ninja Forms Contact Form: Does not properly escape user input before outputting it back in an admin pageCVE-2023-1835 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ninja Forms Contact Form WordPress plugin before 3.6.22 does not properly escape user input before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.6.22
- What to do
- Update Ninja Forms Contact Form to 3.6.22 or newer.
May 8, 2023NEX-Forms: Does not properly escape the `table` parameterCVE-2023-2114 · WordPress plugins & themes · reported by WPScanHigh 7.2
The NEX-Forms WordPress plugin before 8.4 does not properly escape the `table` parameter, which is populated with user input, before concatenating it to an SQL query.
- Product
- NEX-Forms
- Fixed in
- 8.4
- What to do
- Update NEX-Forms to 8.4 or newer.
May 8, 2023Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers to execute arbitrary code via ServerOptions::pid_file.CVE-2023-31039 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers to execute arbitrary code via ServerOptions::pid_file. An attacker that can influence the ServerOptions pid_file parameter with which the bRPC server is started can execute arbitrary code with the permissions of the bRPC process. Solution: 1. upgrade to bRPC >= 1.5.0, download link: https://dist.apache.org/repos/dist/release/brpc/1.5.0/ https://dist.apache.org/repos/dist/release/brpc/1.5.0/ 2. If you are using an old version of bRPC and hard to upgrade, you can apply this patch: https://github.com/apache/brpc/pull/2218 https://github.com/apache/brpc/pull/2218
- Product
- Apache bRPC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Apr 28, 2023Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where input was being parsCVE-2023-30792 · Other software · Meta Platforms, Inc · reported by cve-assign@fb.comMedium 6.1
Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where input was being parsed from untrusted sources.
- Product
- Lexical
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2023Profile Builder – User Profile & User Registration Forms: Unauthorized password resetsCVE-2023-2297 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (wppb_front_end_password_recovery). The function uses the plaintext value of a password reset key instead of a hashed value which means it can easily be retrieved and subsequently used. An attacker can leverage CVE-2023-0814, or another vulnerability like SQL Injection in another plugin or theme installed on the site to successfully exploit this vulnerability.
- Product
- Profile Builder – User Profile & User Registration Forms
- Affected
- up to 3.9.0
- What to do
- Affects up to 3.9.0. Update Profile Builder – User Profile & User Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlana.codesplugins.trac.wordpress.org
Apr 26, 2023Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation.CVE-2022-25273 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 7.5
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023Aigital Wireless-N Repeater Mini_Router v0.131229 was discovered to contain a remote code execution (RCE) vulnerability via the sysCmd parameter in the formSysCCVE-2023-30404 · Other software · Aigital · reported by MITRECritical 9.8
Aigital Wireless-N Repeater Mini_Router v0.131229 was discovered to contain a remote code execution (RCE) vulnerability via the sysCmd parameter in the formSysCmd function. This vulnerability is exploited via a crafted HTTP request.
- Product
- Wireless-n Repeater Mini Router Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmandomat.github.iomandomat.github.io
Apr 25, 2023On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitraryCVE-2023-24512 · Other software · Arista Networks · reported by psirt@arista.comHigh 8.8
On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch. This situation occurs only when the Streaming Telemetry Agent (referred to as the TerminAttr agent) is enabled and gNMI access is configured on the agent. Note: This gNMI over the Streaming Telemetry Agent scenario is mostly commonly used when streaming to a 3rd party system and is not used by default when streaming to CloudVision
- Product
- Terminattr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023Easy Forms for Mailchimp: Does not sanitise and escape some parameters before outputting them back in the responseCVE-2023-1324 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Forms for Mailchimp WordPress plugin before 6.8.8 does not sanitise and escape some parameters before outputting them back in the response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Easy Forms for Mailchimp
- Fixed in
- 6.8.8
- What to do
- Update Easy Forms for Mailchimp to 6.8.8 or newer.
Apr 23, 2023The 'Visforms Base Package for Joomla 3' extension is vulnerable to SQL Injection as concatenation is used to construct an SQL Query.CVE-2023-23753 · Other software · vi-solutions · reported by security@joomla.orgCritical 9.8
The 'Visforms Base Package for Joomla 3' extension is vulnerable to SQL Injection as concatenation is used to construct an SQL Query. An attacker can interact with the database and could be able to read, modify and delete data on it.
- Product
- Visforms Base Package for Joomla 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.asturhackers.esvi-solutions.de
Apr 18, 2023Vulnerability in the Oracle Clinical Remote Data Capture product of Oracle Health Sciences Applications (component: Forms).CVE-2023-21993 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Oracle Clinical Remote Data Capture product of Oracle Health Sciences Applications (component: Forms). The supported version that is affected is 5.4.0.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Clinical Remote Data Capture. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Clinical Remote Data Capture accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
- Product
- Clinical Remote Data Capture Option
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2023Easy Forms for Mailchimp: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-1325 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Forms for Mailchimp WordPress plugin before 6.8.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Easy Forms for Mailchimp
- Fixed in
- 6.8.7
- What to do
- Update Easy Forms for Mailchimp to 6.8.7 or newer.
Apr 13, 2023On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, CVE-2023-24509 · Other software · Arista Networks · reported by psirt@arista.comCritical 9.3
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading to a privilege escalation. Valid user credentials are required in order to exploit this vulnerability.
- Product
- Arista EOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2023On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malfoCVE-2023-24545 · Other software · Arista Networks · reported by psirt@arista.comHigh 7.5
On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malformed packets to the switch. This causes a leak of packet buffers and if enough malformed packets are received, the switch may eventually stop forwarding traffic.
- Product
- EOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2023On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process.CVE-2023-24511 · Other software · Arista Networks · reported by psirt@arista.comMedium 5.3
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process. This may result in the snmpd processing being terminated (causing SNMP requests to time out until snmpd is automatically restarted) and potential memory resource exhaustion for other processes on the switch. The vulnerability does not have any confidentiality or integrity impacts to the system.
- Product
- EOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2023On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malfoCVE-2023-24513 · Other software · Arista Networks · reported by psirt@arista.comMedium 6.5
On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malformed packets to the switch. This causes a leak of packet buffers and if enough malformed packets are received, the switch may eventually stop forwarding traffic.
- Product
- EOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2023SAP HCM Fiori App My Forms (Fiori 2.0) - version 605, does not perform necessary authorization checks for an authenticated user exposing the restricted header dCVE-2023-1903 · Network & remote access · SAP · reported by cna@sap.comMedium 4.3
SAP HCM Fiori App My Forms (Fiori 2.0) - version 605, does not perform necessary authorization checks for an authenticated user exposing the restricted header data.
- Product
- HCM Fiori App My Forms (Fiori 2.0)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Apr 10, 2023Article Directory: Does not properly sanitize the `publish_terms_text` setting before displaying it in the administration panelCVE-2023-0422 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Article Directory WordPress plugin through 1.3 does not properly sanitize the `publish_terms_text` setting before displaying it in the administration panel, which may enable administrators to conduct Stored XSS attacks in multisite contexts.
- Product
- Article Directory
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Article Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2023socket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and FreeBSD), allows local users to send a prCVE-2023-24626 · Other software · GNU · reported by MITREMedium 6.5
socket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and FreeBSD), allows local users to send a privileged SIGHUP signal to any PID, causing a denial of service or disruption of the target process.
- Product
- Screen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.savannah.gnu.orgsavannah.gnu.org
Apr 6, 2023Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the formSetFirewallCfg function.CVE-2023-27021 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the formSetFirewallCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
- Product
- Ac10 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2023Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the formSetFirewallCfg function.CVE-2023-25216 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the formSetFirewallCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted payload.
- Product
- Ac5 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms.CVE-2023-28855 · Other software · pluginsGLPI · reported by GitHubMedium 6.5
Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows any authenticated user to write data to any fields container, including those to which they have no configured access. Versions 1.13.1 and 1.20.4 contain a patch for this issue.
- Product
- fields
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2023Silverstripe Form Capture provides a method to capture simple silverstripe forms and an admin interface for users.CVE-2023-28851 · Other software · bigfork · reported by GitHubMedium 6.1
Silverstripe Form Capture provides a method to capture simple silverstripe forms and an admin interface for users. Starting in version 0.2.0 and prior to versions 1.0.2, 1.1.0, 2.2.5, and 3.1.1, improper escaping when presenting stored form submissions allowed for an attacker to perform a Cross-Site Scripting attack. The vulnerability was initially patched in version 1.0.2, and version 1.1.0 includes this patch. The bug was then accidentally re-introduced during a merge error, and has been re-patched in versions 2.2.5 and 3.1.1. There are no known workarounds for this vulnerability.
- Product
- silverstripe-form-capture
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2023Malwarebytes AdwCleaner 8.4.0 runs as Administrator and performs an insecure file delete operation on C:\AdwCleaner\Logs\AdwCleaner_Debug.log in which the targeCVE-2023-28892 · Other software · Malwarebytes · reported by MITREHigh 7.8
Malwarebytes AdwCleaner 8.4.0 runs as Administrator and performs an insecure file delete operation on C:\AdwCleaner\Logs\AdwCleaner_Debug.log in which the target location is user-controllable, allowing a non-admin user to escalate privileges to SYSTEM via a symbolic link.
- Product
- Adwcleaner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.malwarebytes.commalwarebytes.com
Mar 27, 2023Formidable Forms: Uses several potentially untrusted headers to determine the IP address of the clientCVE-2023-0816 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address spoofing and bypass of anti-spam protections.
- Product
- Formidable Forms
- Fixed in
- 6.1
- What to do
- Update Formidable Forms to 6.1 or newer.
Mar 27, 2023NEX-Forms: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0272 · WordPress plugins & themes · reported by WPScanMedium 5.4
The NEX-Forms WordPress plugin before 8.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- NEX-Forms
- Fixed in
- 8.3.3
- What to do
- Update NEX-Forms to 8.3.3 or newer.
Mar 24, 2023In sms_SendMmCpErrMsg of sms_MmConManagement.c, there is a possible out of bounds write due to a heap buffer overflow.CVE-2022-42499 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.8
In sms_SendMmCpErrMsg of sms_MmConManagement.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-242001391References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 24, 2023Rapid7 InsightVM suffers from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user.CVE-2021-3844 · Other software · Rapid7 · reported by cve@rapid7.comMedium 5.7
Rapid7 InsightVM suffers from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential leak, that user account's current session is still valid after the password change, potentially allowing the attacker who originally compromised the credential to remain logged in and able to cause further damage. This vulnerability is mitigated by the use of the Platform Login feature. This issue is related to CVE-2019-5638.
- Product
- InsightVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.rapid7.comcve.org
Mar 21, 2023x86: speculative vulnerability in 32bit SYSCALL path Due to an oversight in the very original Spectre/Meltdown security work (XSA-254), one entrypath performs iCVE-2022-42331 · Other software · Xen · reported by security@xen.orgMedium 5.5
x86: speculative vulnerability in 32bit SYSCALL path Due to an oversight in the very original Spectre/Meltdown security work (XSA-254), one entrypath performs its speculation-safety actions too late. In some configurations, there is an unprotected RET instruction which can be attacked with a variety of speculative attacks.
- Product
- xen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comxenbits.xen.org
Mar 18, 2023Tenda W20E v15.11.0.6(US_W20EV4.0br_v15.11.0.6(1068_1546_841 is vulnerable to Buffer Overflow via function formSetSysTime,CVE-2023-26806 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda W20E v15.11.0.6(US_W20EV4.0br_v15.11.0.6(1068_1546_841 is vulnerable to Buffer Overflow via function formSetSysTime,
- Product
- W20e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.