Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,801 results · page 44 of 117
Sep 14, 2022Loan Management System 1.0 is vulnerable to SQL Injection at the login page, which allows unauthorized users to login as Administrator after injecting username CVE-2022-37138 · Other software · Razormist · reported by MITRECritical 9.8
Loan Management System 1.0 is vulnerable to SQL Injection at the login page, which allows unauthorized users to login as Administrator after injecting username form.
- Product
- Loan Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Sep 13, 2022In NOKIA 1350 OMS R14.2, Insufficiently Protected Credentials (cleartext administrator password) occur in the edit configuration page.CVE-2022-39816 · Other software · Nokia · reported by MITREMedium 6.5
In NOKIA 1350 OMS R14.2, Insufficiently Protected Credentials (cleartext administrator password) occur in the edit configuration page. Exploitation requires an authenticated attacker.
- Product
- 1350 Optical Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.itgruppotim.it
Sep 13, 2022A CSRF vulnerability in Shopxian CMS 3.0.0 could allow an unauthenticated, remote attacker to craft a malicious link, potentially causing the administrator to pCVE-2022-38329 · Other software · Shopxian · reported by MITREMedium 4.3
A CSRF vulnerability in Shopxian CMS 3.0.0 could allow an unauthenticated, remote attacker to craft a malicious link, potentially causing the administrator to perform unintended actions on an affected system. The vulnerability could allow attackers to modify or delete specific content through crafted requests, potentially leading to data loss and system integrity issues.
- Product
- Shopxian CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalbert5888.github.iogithub.com
Sep 13, 2022Under certain conditions an attacker authenticated as a CMS administrator access the BOE Commentary database and retrieve (non-personal) system data, modify sysCVE-2022-32244 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.2
Under certain conditions an attacker authenticated as a CMS administrator access the BOE Commentary database and retrieve (non-personal) system data, modify system data but can't make the system unavailable. This needs the attacker to have high privilege access to the same physical/logical network to access information which would otherwise be restricted, leading to low impact on confidentiality and high impact on integrity of the application.
- Product
- SAP BusinessObjects Business Intelligence Platform (Commentary DB)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Sep 6, 2022IObit Malware Fighter v9.2 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator privileges to modify processes witCVE-2022-37771 · Other software · Iobit · reported by MITREMedium 6.7
IObit Malware Fighter v9.2 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator privileges to modify processes within the application and escalate privileges to SYSTEM via a crafted executable.
- Product
- Malware Fighter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmrvar0x.compacketstormsecurity.com
Sep 6, 2022PCProtect Endpoint prior to v5.17.470 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator privileges to modify prCVE-2022-36670 · Other software · Pcprotect · reported by MITREMedium 6.7
PCProtect Endpoint prior to v5.17.470 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator privileges to modify processes within the application and escalate privileges to SYSTEM via a crafted executable.
- Product
- Endpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmrvar0x.commrvar0x.com
Sep 1, 2022Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege administrator's passwords.CVE-2022-37435 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege administrator's passwords. This issue affects Apache ShenYu 2.4.2 and 2.4.3.
- Product
- Apache ShenYu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Aug 30, 2022HCL VersionVault Express exposes administrator credentials.CVE-2022-27560 · Other software · HCL Software · reported by psirt@hcl.comMedium 6
HCL VersionVault Express exposes administrator credentials.
- Product
- HCL VersionVault Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Aug 26, 2022An access control issue in the component /ip/admin/ of Edoc-doctor-appointment-system v1.0.1 allows attackers to arbitrarily edit, read, and delete AdministratoCVE-2022-36542 · Other software · Hashenudara · reported by MITREMedium 6.5
An access control issue in the component /ip/admin/ of Edoc-doctor-appointment-system v1.0.1 allows attackers to arbitrarily edit, read, and delete Administrator data.
- Product
- Edoc-doctor-appointment-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2022A malicious unauthorized PAM user can access the administration configuration data and change the values.CVE-2022-25625 · Other software · Broadcom · reported by secure@symantec.comHigh 8.8
A malicious unauthorized PAM user can access the administration configuration data and change the values.
- Product
- Symantec Privileged Access Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.broadcom.comsupport.broadcom.com
Aug 26, 2022Insecure permissions in cskefu v7.0.1 allows unauthenticated attackers to arbitrarily add administrator accounts.CVE-2022-36521 · Other software · Cskefu · reported by MITREHigh 7.5
Insecure permissions in cskefu v7.0.1 allows unauthenticated attackers to arbitrarily add administrator accounts.
- Product
- Cskefu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2022Path traversal vulnerability in PukiWiki versions 1.4.5 to 1.5.3 allows a remote authenticated attacker with an administrative privilege to execute a malicious CVE-2022-34486 · Other software · PukiWiki Development Team · reported by vultures@jpcert.or.jpHigh 7.2
Path traversal vulnerability in PukiWiki versions 1.4.5 to 1.5.3 allows a remote authenticated attacker with an administrative privilege to execute a malicious script via unspecified vectors.
- Product
- PukiWiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jppukiwiki.osdn.jp
Aug 22, 2022Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to alter CSRF settings directly.CVE-2022-35656 · Other software · Pegasystems · reported by security@pega.comMedium 4.5
Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to alter CSRF settings directly.
- Product
- Pega Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.pega.comsupport.pega.com
Aug 22, 2022Insecure Permissions in administration interface in Planex MZK-DP150N 1.42 and 1.43 allows attackers to execute system command as root via etc_ro/web/syscmd.aspCVE-2021-37289 · Other software · Planex · reported by MITREHigh 7.2
Insecure Permissions in administration interface in Planex MZK-DP150N 1.42 and 1.43 allows attackers to execute system command as root via etc_ro/web/syscmd.asp.
- Product
- Mzk-dp150n Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022Hardcoded JWT Secret in AgileConfig <1.6.8 Server allows remote attackers to use the generated JWT token to gain administrator access.CVE-2022-35540 · Other software · Dotnetcore · reported by MITRECritical 9.8
Hardcoded JWT Secret in AgileConfig <1.6.8 Server allows remote attackers to use the generated JWT token to gain administrator access.
- Product
- Agileconfig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2022Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `adminCVE-2022-2336 · Other software · Softing · reported by ics-cert@hq.dhs.govCritical 9.8
Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `admin`. This allows Softing to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the `admin` password. There is no warning or prompt to ask the user to change the default password, and to change the password, many steps are required.
- Product
- Secure Integration Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordindustrial.softing.comcisa.gov
Aug 16, 2022Sequi PortBloque S has an improper authorization vulnerability, which may allow a low-privileged user to perform administrative functions using specifically craCVE-2022-2661 · Other software · Sequi · reported by ics-cert@hq.dhs.govCritical 9.9
Sequi PortBloque S has an improper authorization vulnerability, which may allow a low-privileged user to perform administrative functions using specifically crafted requests.
- Product
- PortBloque S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2022OS command injection vulnerability in Nintendo Wi-Fi Network Adaptor WAP-001 All versions allows an attacker with an administrative privilege to execute arbitraCVE-2022-36381 · Other software · Nintendo Co., Ltd. · reported by vultures@jpcert.or.jpHigh 7.2
OS command injection vulnerability in Nintendo Wi-Fi Network Adaptor WAP-001 All versions allows an attacker with an administrative privilege to execute arbitrary OS commands via unspecified vectors.
- Product
- Nintendo Wi-Fi Network Adaptor WAP-001
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2022Buffer overflow vulnerability in Nintendo Wi-Fi Network Adaptor WAP-001 All versions allows an attacker with an administrative privilege to execute arbitrary coCVE-2022-36293 · Other software · Nintendo Co., Ltd. · reported by vultures@jpcert.or.jpHigh 7.2
Buffer overflow vulnerability in Nintendo Wi-Fi Network Adaptor WAP-001 All versions allows an attacker with an administrative privilege to execute arbitrary code via unspecified vectors.
- Product
- Nintendo Wi-Fi Network Adaptor WAP-001
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2022WP-DBManager: Does not prevent administrators from running arbitrary commands on the server in multisite installationsCVE-2022-2354 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP-DBManager WordPress plugin before 2.80.8 does not prevent administrators from running arbitrary commands on the server in multisite installations, where only super-administrators should.
- Product
- WP-DBManager
- Fixed in
- 2.80.8
- What to do
- Update WP-DBManager to 2.80.8 or newer.
Aug 12, 2022A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScriCVE-2021-42751 · Other software · Thingsboard · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScript within the description of a rule node.
- Product
- Thingsboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compacketstormsecurity.com
Aug 12, 2022A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScriCVE-2021-42750 · Other software · Thingsboard · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScript within the title of a rule node.
- Product
- Thingsboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compacketstormsecurity.com
Aug 12, 2022In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance > Push ConfiguCVE-2021-44720 · Network & remote access · Ivanti · reported by MITREHigh 7.2
In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance > Push Configuration > Targets > Target Name" targets.cgi screen. A read-only administrative user can escalate to a read-write administrative role.
- Product
- Connect Secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comkb.pulsesecure.net
Aug 10, 2022A flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a brute force attack against Administration Console as the applicatiCVE-2022-2457 · Other software · Redhat · reported by Red HatCritical 9.8
A flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a brute force attack against Administration Console as the application does not limit the number of unsuccessful login attempts.
- Product
- Process Automation Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Aug 8, 2022Directorist: Allows administrators to download other plugins from the same vendor directly to the siteCVE-2022-2046 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. This could allow administrators to run code on the server, which is a problem in multisite configurations.
- Product
- Directorist
- Fixed in
- 7.2.3
- What to do
- Update Directorist to 7.2.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Aug 5, 2022Cross-site request forgery (CSRF) vulnerability in administrate 0.1.4 and earlier allows remote attackers to hijack the user's OAuth autorization code.CVE-2016-3098 · Other software · Thoughtbot · reported by Red HatMedium 5.4
Cross-site request forgery (CSRF) vulnerability in administrate 0.1.4 and earlier allows remote attackers to hijack the user's OAuth autorization code.
- Product
- Administrate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Aug 2, 2022In Progress WS_FTP Server prior to version 8.7.3, forms within the administrative interface did not include a nonce to mitigate the risk of cross-site request fCVE-2022-36968 · Other software · Progress · reported by MITREMedium 4.3
In Progress WS_FTP Server prior to version 8.7.3, forms within the administrative interface did not include a nonce to mitigate the risk of cross-site request forgery (CSRF) attacks.
- Product
- Ipswitch WS FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.comprogress.com
Aug 2, 2022In Progress WS_FTP Server prior to version 8.7.3, multiple reflected cross-site scripting (XSS) vulnerabilities exist in the administrative web interface.CVE-2022-36967 · Other software · Progress · reported by MITREMedium 6.1
In Progress WS_FTP Server prior to version 8.7.3, multiple reflected cross-site scripting (XSS) vulnerabilities exist in the administrative web interface. It is possible for a remote attacker to inject arbitrary JavaScript into a WS_FTP administrator's web session. This would allow the attacker to execute code within the context of the victim's browser.
- Product
- Ipswitch WS FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.comprogress.com
Aug 1, 2022Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation (User operation) resulting in elevation of privilege to Administrator group.CVE-2022-26309 · Other software · Artica PFMS · reported by security@pandorafms.comLow 3.7
Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation (User operation) resulting in elevation of privilege to Administrator group.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.comincibe.es
Aug 1, 2022IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to elevate their privilege to platform administrator through manipulatioCVE-2022-30616 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.2
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to elevate their privilege to platform administrator through manipulation of APIs. IBM X-Force ID: 227978.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 25, 2022OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an arbitrary file upload vulnerability via the component /ossn/administrator/cCVE-2022-34965 · Other software · openteknik · reported by MITREHigh 7.2
OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an arbitrary file upload vulnerability via the component /ossn/administrator/com_installer. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file. Note: The project owner believes this is intended behavior of the application as it only allows authenticated admins to upload files.
- Product
- open_source_social_network
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgrimthereaperteam.medium.com
Jul 19, 2022Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administration Daemon).CVE-2022-21514 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administration Daemon). The supported version that is affected is 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
- Product
- Solaris Operating System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2022BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.CVE-2022-27545 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.6
BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.
- Product
- HCL BigFix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jul 18, 2022On Cellinx Camera with guest enabled, attacker with web access can elevate privileges to administrative: "1" to "0" privileges by changing the following cookie CVE-2022-30620 · Other software · Cellinx · reported by cna@cyber.gov.ilHigh 8.2
On Cellinx Camera with guest enabled, attacker with web access can elevate privileges to administrative: "1" to "0" privileges by changing the following cookie values from "is_admin", "showConfig". Administrative Privileges which allows changing various configuration in the camera.
- Product
- Cellinx NVT - IP PTZ Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2022IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper handling of AdministratCVE-2022-22473 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper handling of Administrative Console data. This information could be used in further attacks against the system. IBM X-Force ID: 225347.
- Product
- WebSphere Application Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 13, 2022FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions.CVE-2022-31145 · Other software · flyteorg · reported by GitHubMedium 6.5
FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. In versions 1.1.30 and prior, authenticated users using an external identity provider can continue to use Access Tokens and ID Tokens even after they expire. Users who use FlyteAdmin as the OAuth2 Authorization Server are unaffected by this issue. A patch is available on the `master` branch of the repository. As a workaround, rotating signing keys immediately will invalidate all open sessions and force all users to attempt to obtain new tokens. Those who use this workaround should continue to rotate keys until FlyteAdmin has been upgraded and hide FlyteAdmin deployment ingress URL from the internet.
- Product
- flyteadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2022In finishDrawingWindow of WindowManagerService.java, there is a possible tapjacking due to improper input validation.CVE-2022-20226 · Computers, phones & browsers · Google · reported by security@android.comLow 3.9
In finishDrawingWindow of WindowManagerService.java, there is a possible tapjacking due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-213644870
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jul 12, 2022Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.x - versions 420,430 allows user Administrator to view, edit or modify rights of oCVE-2022-29619 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.5
Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.x - versions 420,430 allows user Administrator to view, edit or modify rights of objects it doesn't own and which would otherwise be restricted.
- Product
- SAP BusinessObjects Business Intelligence Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Jul 8, 2022Digital Guardian Agent 7.7.4.0042 allows an administrator (who ordinarily does not have a supported way to uninstall the product) to disable some of the agent fCVE-2022-35412 · Other software · Digitalguardian · reported by MITREMedium 5.1
Digital Guardian Agent 7.7.4.0042 allows an administrator (who ordinarily does not have a supported way to uninstall the product) to disable some of the agent functionality and then exfiltrate files to an external USB device.
- Product
- Digital Guardian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtenforums.com
Jul 7, 2022Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable endpoint protection by a local administraCVE-2022-23744 · Other software · Checkpoint · reported by cve@checkpoint.comLow 2.3
Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable endpoint protection by a local administrator.
- Product
- Endpoint Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportcenter.checkpoint.comsupportcenter.checkpoint.com
Jul 6, 2022custom-content-type-manager Wordpress plugin can be used by an administrator to achieve arbitrary PHP remote code execution.CVE-2015-3173 · WordPress plugins & themes · reported by Red HatHigh 7.2
custom-content-type-manager Wordpress plugin can be used by an administrator to achieve arbitrary PHP remote code execution.
- Fixed in
- 0.9.8.6
- What to do
- Update the plugin to 0.9.8.6 or newer.
Full record and what to do →NVD recordblog.nettitude.comgithub.com
Jul 6, 2022JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API.CVE-2021-46687 · Other software · JFrog · reported by reefs@jfrog.comMedium 4.9
JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.31.10 versions prior to 7.x; JFrog Artifactory versions before 6.23.38 versions prior to 6.x.
- Product
- JFrog Artifactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2022IBM App Connect Enterprise Certified Container 4.2 could allow a user from the administration console to cause a denial of service by creating a specially craftCVE-2022-31770 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.9
IBM App Connect Enterprise Certified Container 4.2 could allow a user from the administration console to cause a denial of service by creating a specially crafted request. IBM X-Force ID: 228221.
- Product
- App Connect Enterprise Certified Container
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 4, 2022Cross-site scripting vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote authenticated attacker with an administrative privilege to execCVE-2022-29513 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpMedium 4.8
Cross-site scripting vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote authenticated attacker with an administrative privilege to execute an arbitrary script.
- Product
- Cybozu Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 can store a script that could impact other logged in users.CVE-2022-2254 · Other software · Distributed Data Systems · reported by ics-cert@hq.dhs.govMedium 6.2
A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 can store a script that could impact other logged in users.
- Product
- WebHMI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 may send OS commands to execute on the host server.CVE-2022-2253 · Other software · Distributed Data Systems · reported by ics-cert@hq.dhs.govCritical 9.1
A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 may send OS commands to execute on the host server.
- Product
- WebHMI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2022The firmware of EDIMAX IC-3140W Version 3.11 is hardcoded with Administrator username and password.CVE-2021-40597 · Other software · Edimax · reported by MITRECritical 9.8
The firmware of EDIMAX IC-3140W Version 3.11 is hardcoded with Administrator username and password.
- Product
- Ic-3140w Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comdrive.google.com
Jun 28, 2022When an attacker obtaining the administrative account and password, or through a man-in-the-middle attack, the attacker could send a specified crafted packet toCVE-2022-30560 · Network & remote access · Dahuasecurity · reported by cybersecurity@dahuatech.comHigh 7.4
When an attacker obtaining the administrative account and password, or through a man-in-the-middle attack, the attacker could send a specified crafted packet to the vulnerable interface then lead the device to crash.
- Product
- Ipc-hdbw2431e-s-s2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddahuasecurity.comdahuasecurity.com
Jun 28, 2022Use of hard-coded credentials vulnerability exists in STARDOM FCN Controller and FCJ Controller R4.10 to R4.31, which may allow an attacker with an administratiCVE-2022-30997 · Other software · Yokogawa Electric Corporation · reported by vultures@jpcert.or.jpHigh 7.2
Use of hard-coded credentials vulnerability exists in STARDOM FCN Controller and FCJ Controller R4.10 to R4.31, which may allow an attacker with an administrative privilege to read/change configuration settings or update the controller with tampered firmware.
- Product
- STARDOM Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpweb-material3.yokogawa.com
Jun 27, 2022Elcomplus SmartICS v2.3.4.0 does not validate the filenames sufficiently, which enables authenticated administrator-level users to perform path traversal attackCVE-2022-2106 · Other software · Elcomplus · reported by ics-cert@hq.dhs.govLow 3.8
Elcomplus SmartICS v2.3.4.0 does not validate the filenames sufficiently, which enables authenticated administrator-level users to perform path traversal attacks and specify arbitrary files.
- Product
- SmartICS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.