Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,401 results · page 45 of 69
Jun 30, 2022Jenkins OpsGenie Plugin 1.9 and earlier transmits API keys in plain text as part of the global Jenkins configuration form and job configuration forms, potentialCVE-2022-34804 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins OpsGenie Plugin 1.9 and earlier transmits API keys in plain text as part of the global Jenkins configuration form and job configuration forms, potentially resulting in their exposure.
- Product
- Jenkins OpsGenie Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022RG-EG series gateway EG350 EG_RGOS 11.1(6) was discovered to contain a SQL injection vulnerability via the function get_alarmAction at /alarm_pi/alarmService.phCVE-2022-33128 · Other software · Ruijienetworks · reported by MITRECritical 9.1
RG-EG series gateway EG350 EG_RGOS 11.1(6) was discovered to contain a SQL injection vulnerability via the function get_alarmAction at /alarm_pi/alarmService.php.
- Product
- Rg-eg350 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.mo60.cnblog.mo60.cn
Jun 24, 2022Title for CVE: XSS in /dashboard/system/express/entities/forms/save_control/[GUID]: old browsers only.Description: When using Internet Explorer with the XSS proCVE-2022-30118 · Other software · Concretecms · reported by support@hackerone.comMedium 6.1
Title for CVE: XSS in /dashboard/system/express/entities/forms/save_control/[GUID]: old browsers only.Description: When using Internet Explorer with the XSS protection disabled, editing a form control in an express entities form for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 can allow XSS. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 2 with CVSS v3.1 Vector AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N. Thanks zeroinside for reporting.
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.concretecms.orgdocumentation.concretecms.org
Jun 24, 2022A CWE-668 Exposure of Resource to Wrong Sphere vulnerability exists that could cause users to be misled, hiding alarms, showing the wrong server connection optiCVE-2022-32530 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 4.8
A CWE-668 Exposure of Resource to Wrong Sphere vulnerability exists that could cause users to be misled, hiding alarms, showing the wrong server connection option or the wrong control request when a mobile device has been compromised by a malicious application. Affected Product: Geo SCADA Mobile (Build 222 and prior)
- Product
- Geo SCADA Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jun 16, 2022Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2021-36827 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via "label".
- Product
- Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at
- Affected
- up to 3.6.9
- What to do
- Affects up to 3.6.9. Update Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 14, 2022Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/patients/manage_patient.php?id=.CVE-2022-32337 · Other software · Hospital's Patient Records Management System Project · reported by MITRECritical 9.8
Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/patients/manage_patient.php?id=.
- Product
- Hospital's Patient Records Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_patient_admission.CVE-2022-32352 · Other software · Hospital's Patient Records Management System Project · reported by MITRECritical 9.8
Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_patient_admission.
- Product
- Hospital's Patient Records Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_message.CVE-2022-32351 · Other software · Hospital's Patient Records Management System Project · reported by MITREHigh 7.2
Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_message.
- Product
- Hospital's Patient Records Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_room_type.CVE-2022-32350 · Other software · Hospital's Patient Records Management System Project · reported by MITREHigh 7.2
Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_room_type.
- Product
- Hospital's Patient Records Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_patient_history.CVE-2022-32349 · Other software · Hospital's Patient Records Management System Project · reported by MITREHigh 7.2
Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_patient_history.
- Product
- Hospital's Patient Records Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_doctor.CVE-2022-32348 · Other software · Hospital's Patient Records Management System Project · reported by MITREHigh 7.2
Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_doctor.
- Product
- Hospital's Patient Records Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_room.CVE-2022-32347 · Other software · Hospital's Patient Records Management System Project · reported by MITREHigh 7.2
Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_room.
- Product
- Hospital's Patient Records Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/rooms/view_room.php?id=.CVE-2022-32346 · Other software · Hospital's Patient Records Management System Project · reported by MITREHigh 7.2
Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/rooms/view_room.php?id=.
- Product
- Hospital's Patient Records Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/rooms/manage_room.php?id=.CVE-2022-32345 · Other software · Hospital's Patient Records Management System Project · reported by MITREHigh 7.2
Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/rooms/manage_room.php?id=.
- Product
- Hospital's Patient Records Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_patient.CVE-2022-32344 · Other software · Hospital's Patient Records Management System Project · reported by MITREHigh 7.2
Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_patient.
- Product
- Hospital's Patient Records Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via hprms/admin/room_types/manage_room_type.php?id=.CVE-2022-32343 · Other software · Hospital's Patient Records Management System Project · reported by MITREHigh 7.2
Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via hprms/admin/room_types/manage_room_type.php?id=.
- Product
- Hospital's Patient Records Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/room_types/view_room_type.php?id=.CVE-2022-32342 · Other software · Hospital's Patient Records Management System Project · reported by MITREHigh 7.2
Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/room_types/view_room_type.php?id=.
- Product
- Hospital's Patient Records Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/?page=user/manage_user&id=.CVE-2022-32341 · Other software · Hospital's Patient Records Management System Project · reported by MITREHigh 7.2
Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/?page=user/manage_user&id=.
- Product
- Hospital's Patient Records Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/?page=patients/view_patient&id=.CVE-2022-32340 · Other software · Hospital's Patient Records Management System Project · reported by MITREHigh 7.2
Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/?page=patients/view_patient&id=.
- Product
- Hospital's Patient Records Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/doctors/view_doctor.php?id=.CVE-2022-32339 · Other software · Hospital's Patient Records Management System Project · reported by MITREHigh 7.2
Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/doctors/view_doctor.php?id=.
- Product
- Hospital's Patient Records Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/doctors/manage_doctor.php?id=.CVE-2022-32338 · Other software · Hospital's Patient Records Management System Project · reported by MITREHigh 7.2
Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/doctors/manage_doctor.php?id=.
- Product
- Hospital's Patient Records Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2022Open Forms is an application for creating and publishing smart forms.CVE-2022-31041 · Other software · open-formulieren · reported by GitHubHigh 7.6
Open Forms is an application for creating and publishing smart forms. Open Forms supports file uploads as one of the form field types. These fields can be configured to allow only certain file extensions to be uploaded by end users (e.g. only PDF / Excel / ...). The input validation of uploaded files is insufficient in versions prior to 1.0.9 and 1.1.1. Users could alter or strip file extensions to bypass this validation. This results in files being uploaded to the server that are of a different file type than indicated by the file name extension. These files may be downloaded (manually or automatically) by staff and/or other applications for further processing. Malicious files can therefore find their way into internal/trusted networks. Versions 1.0.9 and 1.1.1 contain patches for this issue. As a workaround, an API gateway or intrusion detection solution in front of open-forms may be able to scan for and block malicious content before it reaches the Open Forms application.
- Product
- open-forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2022Open Forms is an application for creating and publishing smart forms.CVE-2022-31040 · Other software · open-formulieren · reported by GitHubHigh 7.1
Open Forms is an application for creating and publishing smart forms. Prior to versions 1.0.9 and 1.1.1, the cookie consent page in Open Forms contains an open redirect by injecting a `referer` querystring parameter and failing to validate the value. A malicious actor is able to redirect users to a website under their control, opening them up for phishing attacks. The redirect is initiated by the open forms backend which is a legimate page, making it less obvious to end users they are being redirected to a malicious website. Versions 1.0.9 and 1.1.1 contain patches for this issue. There are no known workarounds avaialble.
- Product
- open-forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms.CVE-2022-32981 · Computers, phones & browsers · Linux · reported by MITREHigh 7.8
An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point registers.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgit.kernel.org
May 26, 2022A use-after-free flaw was found in the Linux kernel’s pipes functionality in how a user performs manipulations with the pipe post_one_notification() after free_CVE-2022-1882 · Other software · Siemens · reported by Red HatHigh 7.8
A use-after-free flaw was found in the Linux kernel’s pipes functionality in how a user performs manipulations with the pipe post_one_notification() after free_pipe_info() that is already called. This flaw allows a local user to crash or potentially escalate their privileges on the system.
- Product
- SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlore.kernel.org
May 16, 2022The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary CVE-2022-1386 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the server's local network bypassing firewalls and access control measures.
- Product
- Fusion Builder
- Fixed in
- 3.6.2
- What to do
- Update Fusion Builder to 3.6.2 or newer.
Full record and what to do →NVD recordtheme-fusion.comwpscan.com
May 12, 2022An issue was discovered in Stormshield Network Security (SNS) 4.3.x before 4.3.8.CVE-2022-30279 · Other software · Stormshield · reported by MITREHigh 7.5
An issue was discovered in Stormshield Network Security (SNS) 4.3.x before 4.3.8. The event logging of the ASQ sofbus lacbus plugin triggers the dereferencing of a NULL pointer, leading to a crash of SNS. An attacker could exploit this vulnerability via forged sofbus lacbus traffic to cause a firmware crash.
- Product
- Stormshield Network Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.stormshield.euadvisories.stormshield.eu
May 5, 2022In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters formseq and formid in interface\orders\find_order_popup.php leads to multiple cross-site scCVE-2022-29940 · Other software · Librehealth · reported by MITREMedium 5.4
In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters formseq and formid in interface\orders\find_order_popup.php leads to multiple cross-site scripting (XSS) vulnerabilities.
- Product
- Librehealth EHR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via /student-grading-system/rms.php?page=student_p&id=.CVE-2022-28026 · Other software · Oretnom23 · reported by MITRECritical 9.8
Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via /student-grading-system/rms.php?page=student_p&id=.
- Product
- Student Grading System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via /student-grading-system/rms.php?page=school_year.CVE-2022-28025 · Other software · Oretnom23 · reported by MITRECritical 9.8
Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via /student-grading-system/rms.php?page=school_year.
- Product
- Student Grading System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via /student-grading-system/rms.php?page=grade.CVE-2022-28024 · Other software · Oretnom23 · reported by MITRECritical 9.8
Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via /student-grading-system/rms.php?page=grade.
- Product
- Student Grading System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2022Caldera Forms: Does not validate and escape the cf-api parameter before outputting it back in the responseCVE-2022-0879 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Caldera Forms WordPress plugin before 1.9.7 does not validate and escape the cf-api parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting
- Product
- Caldera Forms
- Fixed in
- 1.9.7
- What to do
- Update Caldera Forms to 1.9.7 or newer.
Apr 15, 2022Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into CVE-2022-20727 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.5
Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being authenticated, or conduct a cross-site scripting (XSS) attack against a user of the affected software. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco IOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Apr 15, 2022Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into CVE-2022-20726 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.5
Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being authenticated, or conduct a cross-site scripting (XSS) attack against a user of the affected software. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco IOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Apr 15, 2022Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into CVE-2022-20725 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.5
Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being authenticated, or conduct a cross-site scripting (XSS) attack against a user of the affected software. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco IOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtools.cisco.com
Apr 15, 2022Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into CVE-2022-20724 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.5
Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being authenticated, or conduct a cross-site scripting (XSS) attack against a user of the affected software. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco IOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtools.cisco.com
Apr 15, 2022Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into CVE-2022-20723 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.5
Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being authenticated, or conduct a cross-site scripting (XSS) attack against a user of the affected software. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco IOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtools.cisco.com
Apr 15, 2022Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into CVE-2022-20722 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.5
Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being authenticated, or conduct a cross-site scripting (XSS) attack against a user of the affected software. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco IOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtools.cisco.com
Apr 15, 2022Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into CVE-2022-20721 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.5
Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being authenticated, or conduct a cross-site scripting (XSS) attack against a user of the affected software. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco IOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtools.cisco.com
Apr 15, 2022Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into CVE-2022-20720 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.5
Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being authenticated, or conduct a cross-site scripting (XSS) attack against a user of the affected software. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco IOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtools.cisco.com
Apr 15, 2022Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into CVE-2022-20719 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.5
Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being authenticated, or conduct a cross-site scripting (XSS) attack against a user of the affected software. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco IOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtools.cisco.com
Apr 15, 2022Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into CVE-2022-20718 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.5
Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being authenticated, or conduct a cross-site scripting (XSS) attack against a user of the affected software. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco IOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtools.cisco.com
Apr 15, 2022Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into CVE-2022-20677 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.5
Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being authenticated, or conduct a cross-site scripting (XSS) attack against a user of the affected software. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco IOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Apr 14, 2022On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule CVE-2021-28505 · Other software · Arista Networks · reported by psirt@arista.comHigh 7.5
On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access list will ignore the specified IP protocol.
- Product
- EOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022Post Grid: Does not sanitise and escape the post_types parameter before outputting it back in the response of the post_grid_update_taxonomies_terms_by_posttypes AJAX actionCVE-2022-0447 · WordPress plugins & themes · reported by WPScanMedium 6.4
The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the post_types parameter before outputting it back in the response of the post_grid_update_taxonomies_terms_by_posttypes AJAX action, available to any authenticated users, leading to a Reflected Cross-Site Scripting
- Product
- Post Grid
- Fixed in
- 2.1.16
- What to do
- Update Post Grid to 2.1.16 or newer.
Apr 10, 2022D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanDhcpplus.CVE-2022-27290 · Other software · Dlink · reported by MITREHigh 7.5
D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanDhcpplus. This vulnerability allows attackers to cause a Denial of Service (DoS) via the curTime parameter.
- Product
- Dir-619 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2022D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanL2TP.CVE-2022-27289 · Other software · Dlink · reported by MITREHigh 7.5
D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanL2TP. This vulnerability allows attackers to cause a Denial of Service (DoS) via the curTime parameter.
- Product
- Dir-619 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2022D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanPPTP.CVE-2022-27288 · Other software · Dlink · reported by MITREHigh 7.5
D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanPPTP. This vulnerability allows attackers to cause a Denial of Service (DoS) via the curTime parameter.
- Product
- Dir-619 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2022D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanPPPoE.CVE-2022-27287 · Other software · Dlink · reported by MITREHigh 7.5
D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanPPPoE. This vulnerability allows attackers to cause a Denial of Service (DoS) via the curTime parameter.
- Product
- Dir-619 AX Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2022D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanNonLogin.CVE-2022-27286 · Other software · Dlink · reported by MITREHigh 7.5
D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanNonLogin. This vulnerability allows attackers to cause a Denial of Service (DoS) via the curTime parameter.
- Product
- Dir-619 AX Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.