Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,318 results · page 41 of 67
Apr 6, 2022A use of hard-coded cryptographic key vulnerability [CWE-321] in the registration mechanism of FortiEDR collectors versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allowCVE-2022-23440 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7.8
A use of hard-coded cryptographic key vulnerability [CWE-321] in the registration mechanism of FortiEDR collectors versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allow a local attacker to disable and uninstall the collectors from the end-points within the same deployment.
- Product
- Fortinet FortiEDR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Apr 4, 2022Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows is vulnerable to registry key tampering by users with Administrator privileges.CVE-2022-27608 · Other software · Forcepoint · reported by psirt@forcepoint.comMedium 6
Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows is vulnerable to registry key tampering by users with Administrator privileges. This could result in a user disabling anti-tampering mechanisms which would then allow the user to disable Forcepoint One Endpoint and the protection offered by it.
- Product
- One Endpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.forcepoint.comhelp.forcepoint.com
Apr 4, 2022A hardcoded password was set for accounts registered using an OmniAuth provider (e.g.CVE-2022-1162 · Websites & servers · GitLab · reported by cve@gitlab.comCritical 9.1
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgitlab.com
Apr 1, 2022Modbus Tools Modbus Slave (versions 7.4.2 and prior) is vulnerable to a stack-based buffer overflow in the registration field.CVE-2022-1068 · Other software · Modbus Tools · reported by ics-cert@hq.dhs.govMedium 5.5
Modbus Tools Modbus Slave (versions 7.4.2 and prior) is vulnerable to a stack-based buffer overflow in the registration field. This may cause the program to crash when a long character string is used.
- Product
- Modbus Slave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format.CVE-2022-24798 · Other software · irrdnet · reported by GitHubHigh 7.5
Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. IRRd did not always filter password hashes in query responses relating to `mntner` objects and database exports. This may have allowed adversaries to retrieve some of these hashes, perform a brute-force search for the clear-text passphrase, and use these to make unauthorised changes to affected IRR objects. This issue only affected instances that process password hashes, which means it is limited to IRRd instances that serve authoritative databases. IRRd instances operating solely as mirrors of other IRR databases are not affected. This has been fixed in IRRd 4.2.3 and the main branch. Versions in the 4.1.x series never were affected. Users of the 4.2.x series are strongly recommended to upgrade. There are no known workarounds for this issue.
- Product
- irrd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2022The "Register an Ehcache Configuration File" admin feature in MashZone NextGen through 10.7 GA allows XXE attacks via a malicious XML configuration file.CVE-2021-33208 · Other software · Softwareag · reported by MITREHigh 7.2
The "Register an Ehcache Configuration File" admin feature in MashZone NextGen through 10.7 GA allows XXE attacks via a malicious XML configuration file.
- Product
- Mashzone Nextgen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsoftwareag.com
Mar 30, 2022phpshe V1.8 is affected by a denial of service (DoS) attack in the registry's verification code, which can paralyze the target service.CVE-2022-24132 · Websites & servers · Phpshe · reported by MITREHigh 7.5
phpshe V1.8 is affected by a denial of service (DoS) attack in the registry's verification code, which can paralyze the target service.
- Product
- Phpshe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2022In TelecomManager, there is a possible way to check if a particular self managed phone account was registered on the device due to side channel information discCVE-2021-39788 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In TelecomManager, there is a possible way to check if a particular self managed phone account was registered on the device due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-191768014
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 30, 2022Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to veCVE-2022-25598 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.
- Product
- Apache DolphinScheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Mar 28, 2022OSMapper: Contains an AJAX action to delete a plugin related post type named 'map' and is registered with the wp_ajax_nopriv prefixCVE-2021-24978 · WordPress plugins & themes · reported by WPScanMedium 5.3
The OSMapper WordPress plugin through 2.1.5 contains an AJAX action to delete a plugin related post type named 'map' and is registered with the wp_ajax_nopriv prefix, making it available to unauthenticated users. There is no authorisation, CSRF and checks in place to ensure that the post to delete is a map one. As a result, unauthenticated user can delete arbitrary posts from the blog
- Product
- OSMapper
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update OSMapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2022An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form.CVE-2021-43091 · Other software · Yeswiki · reported by MITREHigh 7.5
An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form.
- Product
- Yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2022wpsupdater.exe in Kingsoft WPS Office through 11.2.0.10382 allows remote code execution by modifying HKEY_CURRENT_USER in the registry.CVE-2022-24934 · Other software · WPS · reported by MITRECritical 9.8
wpsupdater.exe in Kingsoft WPS Office through 11.2.0.10382 allows remote code execution by modifying HKEY_CURRENT_USER in the registry.
- Product
- WPS Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddecoded.avast.iowps.com
Mar 18, 2022Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, which allows registered users with specialCVE-2022-1002 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 2
Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, which allows registered users with special permissions to invite guest users to inject unescaped HTML content in the email invitations.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.commattermost.com
Mar 16, 2022A blind SQL injection vulnerability exists in Xbtit 3.1 via the sid parameter in ajaxchat/getHistoryChatData.php file that is accessible by a registered user.CVE-2021-45821 · Other software · Btiteam · reported by MITREHigh 8.8
A blind SQL injection vulnerability exists in Xbtit 3.1 via the sid parameter in ajaxchat/getHistoryChatData.php file that is accessible by a registered user. As a result, a malicious user can extract sensitive data such as usernames and passwords and in some cases use this vulnerability in order to get a remote code execution on the remote web server.
- Product
- Xbtit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordemaragkos.grgithub.com
Mar 16, 2022In lwis_top_register_io of lwis_device_top.c, there is a possible out of bounds write due to an integer overflow.CVE-2021-39719 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In lwis_top_register_io of lwis_device_top.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-205995178References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 16, 2022In sendSipAccountsRemovedNotification of SipAccountRegistry.java, there is a possible permission bypass due to an unsafe PendingIntent.CVE-2021-39709 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In sendSipAccountsRemovedNotification of SipAccountRegistry.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-208817618
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 14, 2022IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by improper input of application server registraCVE-2021-39051 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by improper input of application server registration function. A remote attacker could exploit this vulnerability using the host address and port fields of the application server registration form in the portal UI to enumerate and attack services that are running on those hosts. IBM X-Force ID: 214441.
- Product
- Spectrum Copy Data Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Mar 10, 2022Veritas System Recovery (VSR) 18 and 21 stores a network destination password in the Windows registry during configuration of the backup configuration.CVE-2022-26778 · Other software · Veritas · reported by MITREMedium 5.3
Veritas System Recovery (VSR) 18 and 21 stores a network destination password in the Windows registry during configuration of the backup configuration. This could allow a Windows user (who has sufficient privileges) to access a network file system that they were not authorized to access.
- Product
- System Recovery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordveritas.comveritas.com
Mar 10, 2022Citrix Federated Authentication Service (FAS) 7.17 - 10.6 causes deployments that have been configured to store a registration authority certificate's private kCVE-2022-26355 · Network & remote access · Citrix · reported by secure@citrix.comMedium 4.4
Citrix Federated Authentication Service (FAS) 7.17 - 10.6 causes deployments that have been configured to store a registration authority certificate's private key in a Trusted Platform Module (TPM) to incorrectly store that key in the Microsoft Software Key Storage Provider (MSKSP). This issue only occurs if PowerShell was used when configuring FAS to store the registration authority certificate’s private key in the TPM. It does not occur if the TPM was not selected for use or if the FAS administration console was used for configuration.
- Product
- Federated Authentication Service (FAS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.citrix.comsupport.citrix.com
Mar 10, 2022A Buffer Overflow vulnerabilitiy exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/register feature, which allows malicious users to exeCVE-2021-44629 · Network & remote access · Tp-link · reported by MITRECritical 9.8
A Buffer Overflow vulnerabilitiy exists in TP-LINK WR-886N 20190826 2.3.8 in the /cloud_config/router_post/register feature, which allows malicious users to execute arbitrary code on the system via a crafted post request.
- Product
- Tl-wr886n Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2022RegistrationMagic: Does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automation admin dashboardCVE-2022-0420 · WordPress plugins & themes · reported by WPScanHigh 7.2
The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automation admin dashboard, allowing high privilege users to perform SQL injection attacks
- Product
- RegistrationMagic
- Fixed in
- 5.0.2.2
- What to do
- Update RegistrationMagic to 5.0.2.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 3, 2022A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggerCVE-2021-3640 · Computers, phones & browsers · Linux · reported by Red HatHigh 7
A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A privileged local user could use this flaw to crash the system or escalate their privileges on the system.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgit.kernel.org
Mar 2, 2022Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY_LOCAL_MACHINE via UITasks.PersistentRegistryDCVE-2022-25089 · Other software · Kofax · reported by MITRECritical 9.8
Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY_LOCAL_MACHINE via UITasks.PersistentRegistryData.
- Product
- Printix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 2, 2022Event Management v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the full_name parameter under register.php.CVE-2022-25114 · Other software · Event Management Project · reported by MITREMedium 6.1
Event Management v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the full_name parameter under register.php.
- Product
- Event Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2022Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration.CVE-2022-0377 · WordPress plugins & themes · reported by WPScanMedium 4.3
Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process the user crops and saves the image. Then a "POST" request that contains user supplied name of the image is sent to the server for renaming and cropping of the image. As a result of this request, the name of the user-supplied image is changed with a MD5 value. This process can be conducted only when type of the image is JPG or PNG. An attacker can use this vulnerability in order to rename an arbitrary image file. By doing this, they could destroy the design of the web site.
- Product
- LearnPress
- Fixed in
- 4.1.5
- What to do
- Update LearnPress to 4.1.5 or newer.
Full record and what to do →NVD recordbozogullarindan.comgithub.com
Feb 25, 2022JetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use (TOCTOU) race-condition attack in agent registration via XML-RPC.CVE-2022-24335 · Other software · Jetbrains · reported by MITREHigh 8.1
JetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use (TOCTOU) race-condition attack in agent registration via XML-RPC.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Feb 24, 2022Profile Builder – User Profile & User Registration Forms: Cross-Site ScriptingCVE-2022-0653 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the site_url parameter found in the ~/assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 3.6.1.
- Product
- Profile Builder – User Profile & User Registration Forms
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update Profile Builder – User Profile & User Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 21, 2022Open Redirect on Rudloff/alltube in Packagist rudloff/alltube prior to 3.0.1.CVE-2022-0692 · Other software · rudloff · reported by security@huntr.devMedium 6.1
Open Redirect on Rudloff/alltube in Packagist rudloff/alltube prior to 3.0.1.
- Product
- rudloff/alltube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2022Business Logic Errors in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0688 · Other software · microweber · reported by security@huntr.devMedium 4.9
Business Logic Errors in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2022Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0690 · Other software · microweber · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2022Use multiple time the one-time coupon in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0689 · Other software · microweber · reported by security@huntr.devMedium 5.3
Use multiple time the one-time coupon in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2022Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0678 · Other software · microweber · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2022Unrestricted Upload of File with Dangerous Type in Packagist showdoc/showdoc prior to 2.10.2.CVE-2022-0409 · Other software · star7th · reported by security@huntr.devHigh 7.8
Unrestricted Upload of File with Dangerous Type in Packagist showdoc/showdoc prior to 2.10.2.
- Product
- star7th/showdoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project.CVE-2022-23649 · Other software · sigstore · reported by GitHubLow 3.3
Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and push permissions for the signature in OCI. This can happen with both standard signing with a keypair and "keyless signing" with Fulcio. If an attacker has access to the signature in OCI, they can manipulate cosign into believing the entry was stored in Rekor even though it wasn't. The vulnerability has been patched in v1.5.2 of Cosign. The `signature` in the `signedEntryTimestamp` provided by Rekor is now compared to the `signature` that is being verified. If these don't match, then an error is returned. If a valid bundle is copied to a different signature, verification should fail. Cosign output now only informs the user that certificates were verified if a certificate was in fact verified. There is currently no known workaround.
- Product
- cosign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0666 · Other software · microweber · reported by security@huntr.devHigh 7.5
CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0660 · Other software · microweber · reported by security@huntr.devHigh 7.5
Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2022Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0638 · Other software · microweber · reported by security@huntr.devMedium 4.3
Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2022Generation of Error Message Containing Sensitive Information in Packagist snipe/snipe-it prior to 5.3.11.CVE-2022-0622 · Other software · snipe · reported by security@huntr.devMedium 5.3
Generation of Error Message Containing Sensitive Information in Packagist snipe/snipe-it prior to 5.3.11.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2022Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-0612 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11.CVE-2022-0611 · Other software · snipe · reported by security@huntr.devMedium 6.3
Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022Hospital Management System v4.0 was discovered to contain a blind SQL injection vulnerability via the register function in func2.php.CVE-2022-24226 · Websites & servers · Phpgurukul · reported by MITREHigh 7.5
Hospital Management System v4.0 was discovered to contain a blind SQL injection vulnerability via the register function in func2.php.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022Open Redirect in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0597 · Other software · microweber · reported by security@huntr.devMedium 6.1
Open Redirect in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022Improper Validation of Specified Quantity in Input in Packagist microweber/microweber prior to 1.2.11.CVE-2022-0596 · Other software · microweber · reported by security@huntr.devMedium 4.3
Improper Validation of Specified Quantity in Input in Packagist microweber/microweber prior to 1.2.11.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.1.0.CVE-2022-0589 · Other software · librenms · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.1.0.
- Product
- librenms/librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022Missing Authorization in Packagist librenms/librenms prior to 22.2.0.CVE-2022-0588 · Other software · librenms · reported by security@huntr.devHigh 7.1
Missing Authorization in Packagist librenms/librenms prior to 22.2.0.
- Product
- librenms/librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022Improper Authorization in Packagist librenms/librenms prior to 22.2.0.CVE-2022-0587 · Other software · librenms · reported by security@huntr.devMedium 6.5
Improper Authorization in Packagist librenms/librenms prior to 22.2.0.
- Product
- librenms/librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022Incorrect Authorization in Packagist librenms/librenms prior to 22.2.0.CVE-2022-0580 · Other software · librenms · reported by security@huntr.devHigh 7.1
Incorrect Authorization in Packagist librenms/librenms prior to 22.2.0.
- Product
- librenms/librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9.CVE-2022-0579 · Other software · snipe · reported by security@huntr.devMedium 6.5
Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022Cross-site Scripting (XSS) - Generic in Packagist librenms/librenms prior to 22.1.0.CVE-2022-0576 · Other software · librenms · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Generic in Packagist librenms/librenms prior to 22.1.0.
- Product
- librenms/librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.2.0.CVE-2022-0575 · Other software · librenms · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.2.0.
- Product
- librenms/librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.