Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,792 results · page 42 of 76
Jul 10, 2022The Niyaz-Mohamed/mosaic repository through 1.0.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31521 · Other software · Mosaic Project · reported by MITRECritical 9.3
The Niyaz-Mohamed/mosaic repository through 1.0.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Mosaic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The Luxas98/logstash-management-api repository through 2020-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafelyCVE-2022-31520 · Other software · Logstash-management-api Project · reported by MITRECritical 9.3
The Luxas98/logstash-management-api repository through 2020-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Logstash-management-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The Lukasavicus/WindMill repository through 1.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31519 · Other software · Windmill Project · reported by MITRECritical 9.3
The Lukasavicus/WindMill repository through 1.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Windmill
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The JustAnotherSoftwareDeveloper/Python-Recipe-Database repository through 2021-03-31 on GitHub allows absolute path traversal because the Flask send_file functCVE-2022-31518 · Other software · Python-recipe-database Project · reported by MITRECritical 9.3
The JustAnotherSoftwareDeveloper/Python-Recipe-Database repository through 2021-03-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Python-recipe-database
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The HolgerGraef/MSM repository through 2021-04-20 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31517 · Other software · Mercury Sample Manager Project · reported by MITRECritical 9.3
The HolgerGraef/MSM repository through 2021-04-20 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Mercury Sample Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The Harveyzyh/Python repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31516 · Other software · Harveyzyh Python Project · reported by MITRECritical 9.3
The Harveyzyh/Python repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Harveyzyh Python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The Delor4/CarceresBE repository through 1.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31515 · Other software · Carceresbe Project · reported by MITRECritical 9.3
The Delor4/CarceresBE repository through 1.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Carceresbe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The Caoyongqi912/Fan_Platform repository through 2021-04-20 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31514 · Other software · FAN Platform Project · reported by MITRECritical 9.3
The Caoyongqi912/Fan_Platform repository through 2021-04-20 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- FAN Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The BolunHan/Krypton repository through 2021-06-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31513 · Other software · Krypton Project · reported by MITRECritical 9.3
The BolunHan/Krypton repository through 2021-06-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Krypton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The Atom02/flask-mvc repository through 2020-09-14 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31512 · Other software · Flask-mvc Project · reported by MITRECritical 9.3
The Atom02/flask-mvc repository through 2020-09-14 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Flask-mvc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The AFDudley/equanimity repository through 2014-04-23 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31511 · Other software · Equanimity Project · reported by MITRECritical 9.3
The AFDudley/equanimity repository through 2014-04-23 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Equanimity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The sergeKashkin/Simple-RAT repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31510 · Other software · Simple-rat Project · reported by MITRECritical 9.3
The sergeKashkin/Simple-RAT repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Simple-rat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The iedadata/usap-dc-website repository through 1.0.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31509 · Other software · Iedadata · reported by MITRECritical 9.3
The iedadata/usap-dc-website repository through 1.0.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Usap-dc Web Submission And Dataset Search
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The idayrus/evoting repository before 2022-05-08 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31508 · Other software · Idayrus · reported by MITRECritical 9.3
The idayrus/evoting repository before 2022-05-08 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- E-voting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The ganga-devs/ganga repository before 8.5.10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31507 · Other software · Ganga Project · reported by MITRECritical 9.3
The ganga-devs/ganga repository before 8.5.10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Ganga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The cmusatyalab/opendiamond repository through 10.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31506 · Other software · CMU · reported by MITRECritical 9.3
The cmusatyalab/opendiamond repository through 10.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Opendiamond
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The cheo0/MercadoEnLineaBack repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31505 · Other software · Mercadoenlineaback Project · reported by MITRECritical 9.3
The cheo0/MercadoEnLineaBack repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Mercadoenlineaback
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The ChangeWeDer/BaiduWenkuSpider_flaskWeb repository before 2021-11-29 on GitHub allows absolute path traversal because the Flask send_file function is used unsCVE-2022-31504 · Other software · Baiduwenkuspider Flaskweb Project · reported by MITRECritical 9.3
The ChangeWeDer/BaiduWenkuSpider_flaskWeb repository before 2021-11-29 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Baiduwenkuspider Flaskweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The orchest/orchest repository before 2022.05.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31503 · Other software · Orchest · reported by MITRECritical 9.3
The orchest/orchest repository before 2022.05.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Orchest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The operatorequals/wormnest repository through 0.4.7 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31502 · Other software · Wormnest Project · reported by MITRECritical 9.3
The operatorequals/wormnest repository through 0.4.7 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Wormnest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The ChaoticOnyx/OnyxForum repository before 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31501 · Other software · Onyxforum Project · reported by MITRECritical 9.3
The ChaoticOnyx/OnyxForum repository before 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Onyxforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2022OpenVPN Access Server 2.10 and prior versions are susceptible to resending multiple packets in a response to a reset packet sent from the client which the clienCVE-2021-4234 · Other software · Openvpn · reported by security@openvpn.netHigh 7.5
OpenVPN Access Server 2.10 and prior versions are susceptible to resending multiple packets in a response to a reset packet sent from the client which the client again does not respond to, resulting in a limited amplification attack.
- Product
- Openvpn Access Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenvpn.netopenvpn.net
Jul 6, 2022Editable SQL Queries behind Base64 encoding sending from the Client-Side to The Server-Side for a particular API used in legacy Work Center module.CVE-2022-30619 · Other software · Agile Point · reported by cna@cyber.gov.ilMedium 5.9
Editable SQL Queries behind Base64 encoding sending from the Client-Side to The Server-Side for a particular API used in legacy Work Center module. He attack is available for any authenticated user, in any kind of rule. under the function : /AgilePointServer/Extension/FetchUsingEncodedData in the parameter: EncodedData
- Product
- Agile Point NX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2022IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot sends HTTP requests in their update procedure in orCVE-2022-24140 · Other software · Iobit · reported by MITREMedium 6.6
IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot sends HTTP requests in their update procedure in order to download a config file. After downloading the config file, the products will parse the HTTP location of the update from the file and will try to install the update automatically with ADMIN privileges. An attacker Intercepting this communication can supply the product a fake config file with malicious locations for the updates thus gaining a remote code execution on an endpoint.
- Product
- Advanced System Care
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2022An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users.CVE-2022-35230 · Other software · Zabbix · reported by security@zabbix.comLow 3.7
An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.
- Product
- Frontend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgsupport.zabbix.com
Jul 6, 2022An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users.CVE-2022-35229 · Other software · Zabbix · reported by security@zabbix.comLow 3.7
An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.
- Product
- Frontend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.debian.org
Jul 5, 2022Old session tokens can be used to authenticate to the application and send authenticated requests.CVE-2022-2306 · Other software · heroiclabs · reported by security@huntr.devHigh 7.5
Old session tokens can be used to authenticate to the application and send authenticated requests.
- Product
- heroiclabs/nakama
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022The package link-preview-js before 2.1.16 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local neCVE-2022-25876 · Other software · Link-preview-js Project · reported by report@snyk.ioMedium 6.2
The package link-preview-js before 2.1.16 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local network and read the response. This is due to flawed DNS rebinding protection.
- Product
- Link-preview-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 may send OS commands to execute on the host server.CVE-2022-2253 · Other software · Distributed Data Systems · reported by ics-cert@hq.dhs.govCritical 9.1
A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 may send OS commands to execute on the host server.
- Product
- WebHMI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Missing permission checks in Jenkins Recipe Plugin 1.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specifiedCVE-2022-34794 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Missing permission checks in Jenkins Recipe Plugin 1.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML.
- Product
- Jenkins Recipe Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022A cross-site request forgery (CSRF) vulnerability in Jenkins Recipe Plugin 1.2 and earlier allows attackers to send an HTTP request to an attacker-specified URLCVE-2022-34792 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8
A cross-site request forgery (CSRF) vulnerability in Jenkins Recipe Plugin 1.2 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML.
- Product
- Jenkins Recipe Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14 could allow a remote attacker to gain details of the database, such as type and version, by sendCVE-2022-22494 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14 could allow a remote attacker to gain details of the database, such as type and version, by sending a specially-crafted HTTP request. This information could then be used in future attacks. IBM X-Force ID: 226940.
- Product
- Spectrum Protect Operations Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 28, 2022When an attacker obtaining the administrative account and password, or through a man-in-the-middle attack, the attacker could send a specified crafted packet toCVE-2022-30560 · Network & remote access · Dahuasecurity · reported by cybersecurity@dahuatech.comHigh 7.4
When an attacker obtaining the administrative account and password, or through a man-in-the-middle attack, the attacker could send a specified crafted packet to the vulnerable interface then lead the device to crash.
- Product
- Ipc-hdbw2431e-s-s2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddahuasecurity.comdahuasecurity.com
Jun 27, 2022A vulnerability, which was classified as problematic, was found in ProjectSend r754.CVE-2017-20101 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in ProjectSend r754. This affects an unknown part of the file process.php?do=zip_download. The manipulation of the argument client/file leads to information disclosure. It is possible to initiate the attack remotely.
- Product
- ProjectSend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022IBM CICS TX Standard and Advanced 11.1 could allow a remote attacker to execute arbitrary commands on the system by sending a specially crafted request.CVE-2022-31767 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM CICS TX Standard and Advanced 11.1 could allow a remote attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 227980.
- Product
- CICS TX Advanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 23, 2022A missing permission check in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request toCVE-2022-34212 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.7
A missing permission check in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request to an attacker-specified URL.
- Product
- Jenkins vRealize Orchestrator Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022A cross-site request forgery (CSRF) vulnerability in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers to send an HTTP POST request to an atCVE-2022-34211 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
A cross-site request forgery (CSRF) vulnerability in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers to send an HTTP POST request to an attacker-specified URL.
- Product
- Jenkins vRealize Orchestrator Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022A missing permission check in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers with Overall/Read permission to send HTTP POST requests to aCVE-2022-34206 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A missing permission check in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers with Overall/Read permission to send HTTP POST requests to an attacker-specified URL.
- Product
- Jenkins Jianliao Notification Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022A cross-site request forgery (CSRF) vulnerability in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers to send HTTP POST requests to an attaCVE-2022-34205 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
A cross-site request forgery (CSRF) vulnerability in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers to send HTTP POST requests to an attacker-specified URL.
- Product
- Jenkins Jianliao Notification Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2022In motor-admin versions 0.0.1 through 0.2.56 are vulnerable to host header injection in the password reset functionality where malicious actor can send fake pasCVE-2022-23079 · Other software · motor-admin · reported by vulnerabilitylab@mend.ioMedium 6.8
In motor-admin versions 0.0.1 through 0.2.56 are vulnerable to host header injection in the password reset functionality where malicious actor can send fake password reset email to arbitrary victim.
- Product
- motor-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2022AtlasVPN - Privilege Escalation Lack of proper security controls on named pipe messages can allow an attacker with low privileges to send a malicious payload anCVE-2022-23171 · Other software · AtlasVPN · reported by cna@cyber.gov.ilMedium 5.9
AtlasVPN - Privilege Escalation Lack of proper security controls on named pipe messages can allow an attacker with low privileges to send a malicious payload and gain SYSTEM permissions on a windows computer where the AtlasVPN client is installed.
- Product
- AtlasVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2022In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-syCVE-2022-24562 · Other software · Iobit · reported by MITRECritical 9.8
In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-system (with admin privileges) on the victim's endpoint, which can result in data theft and remote code execution.
- Product
- Iotransfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.commedium.com
Jun 15, 2022YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the MailSendID parameter at /App/Lib/Action/Admin/MailAction.class.php.CVE-2022-32300 · Other software · Youdiancms · reported by MITREHigh 8.8
YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the MailSendID parameter at /App/Lib/Action/Admin/MailAction.class.php.
- Product
- Youdiancms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2022In ACTION_MANAGED_PROFILE_PROVISIONED of DevicePolicyManagerService.java, there is a possible way for unprivileged app to send MANAGED_PROFILE_PROVISIONED intenCVE-2022-20138 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In ACTION_MANAGED_PROFILE_PROVISIONED of DevicePolicyManagerService.java, there is a possible way for unprivileged app to send MANAGED_PROFILE_PROVISIONED intent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-210469972
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 14, 2022Improper validation of tag id while RRC sending tag id to MAC can lead to TOCTOU race condition in Snapdragon Connectivity, Snapdragon MobileCVE-2021-35111 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Improper validation of tag id while RRC sending tag id to MAC can lead to TOCTOU race condition in Snapdragon Connectivity, Snapdragon Mobile
- Product
- Snapdragon Connectivity, Snapdragon Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jun 9, 2022Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism.CVE-2022-31813 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.
- Product
- Apache HTTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comhttpd.apache.org
Jun 7, 2022Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionError function of Bluetooth prior to SMR JuCVE-2022-30725 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionError function of Bluetooth prior to SMR Jun-2022 Release 1 leaks MAC address of the connected Bluetooth device.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jun 7, 2022Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionCompleted function of Bluetooth prior to SMCVE-2022-30724 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionCompleted function of Bluetooth prior to SMR Jun-2022 Release 1 leaks MAC address of the connected Bluetooth device.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jun 7, 2022Unprotected broadcast in sendIntentForToastDumpLog in DisplayToast prior to SMR Jun-2022 Release 1 allows untrusted applications to access toast message informaCVE-2022-30716 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Unprotected broadcast in sendIntentForToastDumpLog in DisplayToast prior to SMR Jun-2022 Release 1 allows untrusted applications to access toast message information from device.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jun 6, 2022Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and `jodd.http.HttpRequest#send.CVE-2022-29631 · Other software · Jodd · reported by MITREHigh 7.5
Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and `jodd.http.HttpRequest#send. These vulnerabilities allow attackers to execute Server-Side Request Forgery (SSRF) via a crafted TCP payload.
- Product
- Jodd Http
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.