Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
670 results · page 5 of 14
May 20, 2024Quanxun Huiju Network Technology (Beijing) Co.,Ltd IK-Q3000 3.7.10 x64 Build202401261655 was discovered to be vulnerable to an ICMP redirect attack.CVE-2024-34947 · Other software · reported by MITRECritical 9.4
Quanxun Huiju Network Technology (Beijing) Co.,Ltd IK-Q3000 3.7.10 x64 Build202401261655 was discovered to be vulnerable to an ICMP redirect attack.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
May 17, 2024In the Linux kernel, the following vulnerability has been resolved: icmp: prevent possible NULL dereferences from icmp_build_probe() First problem is a doubleCVE-2024-35857 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.5
In the Linux kernel, the following vulnerability has been resolved: icmp: prevent possible NULL dereferences from icmp_build_probe() First problem is a double call to __in_dev_get_rcu(), because the second one could return NULL. if (__in_dev_get_rcu(dev) && __in_dev_get_rcu(dev)->ifa_list) Second problem is a read from dev->ip6_ptr with no NULL check: if (!list_empty(&rcu_dereference(dev->ip6_ptr)->addr_list)) Use the correct RCU API to fix these. v2: add missing include <net/addrconf.h>
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 8, 2024jizhicms v2.5.1 contains a Cross-Site Scripting(XSS) vulnerability in the message function.CVE-2024-34255 · Other software · cherry-toto · reported by MITREMedium 6.1
jizhicms v2.5.1 contains a Cross-Site Scripting(XSS) vulnerability in the message function.
- Product
- jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2024Cross Site Scripting vulnerability in jizhicms v.2.5.4 allows a remote attacker to obtain sensitive information via a crafted article publication request.CVE-2024-33338 · Other software · Jizhicms · reported by MITREHigh 7.3
Cross Site Scripting vulnerability in jizhicms v.2.5.4 allows a remote attacker to obtain sensitive information via a crafted article publication request.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2024Cross Site Scripting vulnerability in MiniCMS v.1.11 allows a remote attacker to run arbitrary code via crafted string in the URL after login.CVE-2024-31741 · Other software · minicms_project · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in MiniCMS v.1.11 allows a remote attacker to run arbitrary code via crafted string in the URL after login.
- Product
- minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2024A stored cross-site scripting (XSS) vulnerability in the component \affiche\admin\index.php of WUZHICMS v4.1.0 allows attackers to execute arbitrary web scriptsCVE-2024-32206 · Other software · wuzhicms · reported by MITREMedium 4.6
A stored cross-site scripting (XSS) vulnerability in the component \affiche\admin\index.php of WUZHICMS v4.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $formdata parameter.
- Product
- wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024jizhiCMS 2.5 suffers from a File upload vulnerability.CVE-2024-32161 · Other software · jizhicms · reported by MITRECritical 9.8
jizhiCMS 2.5 suffers from a File upload vulnerability.
- Product
- jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024Cross Site Scripting (XSS) vulnerability in Xunruicms versions 4.6.3 and before, allows remote attacker to execute arbitrary code via the Security.php file in tCVE-2024-31634 · Other software · Xunruicms · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in Xunruicms versions 4.6.3 and before, allows remote attacker to execute arbitrary code via the Security.php file in the catalog \XunRuiCMS\dayrui\Fcms\Library.
- Product
- Xunruicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2024An Improper Input Validation vulnerability in Juniper Tunnel Driver (jtd) and ICMP module of Juniper Networks Junos OS Evolved allows an unauthenticated attackeCVE-2024-21590 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 7.1
An Improper Input Validation vulnerability in Juniper Tunnel Driver (jtd) and ICMP module of Juniper Networks Junos OS Evolved allows an unauthenticated attacker within the MPLS administrative domain to send specifically crafted packets to the Routing Engine (RE) to cause a Denial of Service (DoS). When specifically crafted transit MPLS IPv4 packets are received by the Packet Forwarding Engine (PFE), these packets are internally forwarded to the RE. Continued receipt of these packets may create a sustained Denial of Service (DoS) condition. This issue affects Juniper Networks Junos OS: * All versions before 21.2R3-S8-EVO; * from 21.4-EVO before 21.4R3-S6-EVO; * from 22.2-EVO before 22.2R3-S4-EVO; * from 22.3-EVO before 22.3R3-S3-EVO; * from 22.4-EVO before 22.4R3-EVO; * from 23.2-EVO before 23.2R2-EVO. * from 23.4-EVO before 23.4R1-S1-EVO.
- Product
- Junos OS Evolved
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportportal.juniper.netfirst.org
Apr 5, 2024InstantCMS is a free and open source content management system.CVE-2024-31213 · Other software · instantsoft · reported by GitHubLow 3.5
InstantCMS is a free and open source content management system. An open redirect was found in the ICMS2 application version 2.16.2 when being redirected after modifying one's own user profile. An attacker could trick a victim into visiting their web application, thinking they are still present on the ICMS2 application. They could then host a website stating "To update your profile, please enter your password," upon which the user may type their password and send it to the attacker. As of time of publication, a patched version is not available.
- Product
- icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2024InstantCMS is a free and open source content management system.CVE-2024-31212 · Other software · instantsoft · reported by GitHubMedium 6.7
InstantCMS is a free and open source content management system. A SQL injection vulnerability affects instantcms v2.16.2 in which an attacker with administrative privileges can cause the application to execute unauthorized SQL code. The vulnerability exists in index_chart_data action, which receives an input from user and passes it unsanitized to the core model `filterFunc` function that further embeds this data in an SQL statement. This allows attackers to inject unwanted SQL code into the statement. The `period` should be escaped before inserting it in the query. As of time of publication, a patched version is not available.
- Product
- icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2024An issue was discovered in WUZHICMS version 4.1.0, allows an attacker to execute arbitrary code and obtain sensitive information via the index.php file.CVE-2024-31008 · Other software · wuzhicms · reported by MITREMedium 6.5
An issue was discovered in WUZHICMS version 4.1.0, allows an attacker to execute arbitrary code and obtain sensitive information via the index.php file.
- Product
- wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2024In the Linux kernel, the following vulnerability has been resolved: tunnels: fix out of bounds access when building IPv6 PMTU error If the ICMPv6 error is buiCVE-2024-26665 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.1
In the Linux kernel, the following vulnerability has been resolved: tunnels: fix out of bounds access when building IPv6 PMTU error If the ICMPv6 error is built from a non-linear skb we get the following splat, BUG: KASAN: slab-out-of-bounds in do_csum+0x220/0x240 Read of size 4 at addr ffff88811d402c80 by task netperf/820 CPU: 0 PID: 820 Comm: netperf Not tainted 6.8.0-rc1+ #543 ... kasan_report+0xd8/0x110 do_csum+0x220/0x240 csum_partial+0xc/0x20 skb_tunnel_check_pmtu+0xeb9/0x3280 vxlan_xmit_one+0x14c2/0x4080 vxlan_xmit+0xf61/0x5c00 dev_hard_start_xmit+0xfb/0x510 __dev_queue_xmit+0x7cd/0x32a0 br_dev_queue_push_xmit+0x39d/0x6a0 Use skb_checksum instead of csum_partial who cannot deal with non-linear SKBs.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 26, 2024A vulnerability, which was classified as problematic, was found in Tianjin PubliCMS 4.0.202302.e.CVE-2024-2911 · Other software · Tianjin · reported by VulDBMedium 6.9
A vulnerability, which was classified as problematic, was found in Tianjin PubliCMS 4.0.202302.e. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PubliCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024A vulnerability, which was classified as critical, was found in ZhiCms 4.0.CVE-2024-2016 · Other software · zhicms · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in ZhiCms 4.0. Affected is the function index of the file app/manage/controller/setcontroller.php. The manipulation of the argument sitename leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-255270 is the identifier assigned to this vulnerability.
- Product
- zhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Mar 20, 2024A vulnerability, which was classified as critical, has been found in ZhiCms 4.0.CVE-2024-2015 · Other software · Zhicms · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in ZhiCms 4.0. This issue affects the function getindexdata of the file app/index/controller/mcontroller.php. The manipulation of the argument key leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255269 was assigned to this vulnerability.
- Product
- Zhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Mar 18, 2024SecureProps is a PHP library designed to simplify the encryption and decryption of property data in objects.CVE-2024-28864 · Other software · IlicMiljan · reported by GitHubLow 2.6
SecureProps is a PHP library designed to simplify the encryption and decryption of property data in objects. A vulnerability in SecureProps version 1.2.0 and 1.2.1 involves a regex failing to detect tags during decryption of encrypted data. This occurs when the encrypted data has been encoded with `NullEncoder` and passed to `TagAwareCipher`, and contains special characters such as `\n`. As a result, the decryption process is skipped since the tags are not detected. This causes the encrypted data to be returned in plain format. The vulnerability affects users who implement `TagAwareCipher` with any base cipher that has `NullEncoder` (not default). The patch for the issue has been released. Users are advised to update to version 1.2.2. As a workaround, one may use the default `Base64Encoder` with the base cipher decorated with `TagAwareCipher` to prevent special characters in the encrypted string from interfering with regex tag detection logic. This workaround is safe but may involve double encoding since `TagAwareCipher` uses `NullEncoder` by default.
- Product
- Secure-Props
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2024In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: fix NULL-deref on disconnect Commit 9d7b18668956 ("HID: magicmouse: add sCVE-2021-47120 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: fix NULL-deref on disconnect Commit 9d7b18668956 ("HID: magicmouse: add support for Apple Magic Trackpad 2") added a sanity check for an Apple trackpad but returned success instead of -ENODEV when the check failed. This means that the remove callback will dereference the never-initialised driver data pointer when the driver is later unbound (e.g. on USB disconnect).
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 6, 2024A cross-site scripting (XSS) vulnerability in XunRuiCMS up to v4.6.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected inCVE-2024-24389 · Other software · Xunruicms · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in XunRuiCMS up to v4.6.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Add Column Name parameter.
- Product
- Xunruicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordj11zuc9f0h2.feishu.cnj11zuc9f0h2.feishu.cn
Mar 1, 2024 A weak encoding is used to transmit credentials for WS203VICM.CVE-2024-23492 · Other software · Commend · reported by ics-cert@hq.dhs.govMedium 5.7
A weak encoding is used to transmit credentials for WS203VICM.
- Product
- WS203VICM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclibrary-online.commend.comcisa.gov
Mar 1, 2024A remote, unauthenticated attacker may be able to send crafted messages to the web server of the Commend WS203VICM causing the system to restart, interruptingCVE-2024-22182 · Other software · Commend · reported by ics-cert@hq.dhs.govHigh 8.6
A remote, unauthenticated attacker may be able to send crafted messages to the web server of the Commend WS203VICM causing the system to restart, interrupting service.
- Product
- WS203VICM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclibrary-online.commend.comcisa.gov
Mar 1, 2024 A remote attacker may be able to bypass access control of Commend WS203VICM by creating a malicious request.CVE-2024-21767 · Other software · Commend · reported by ics-cert@hq.dhs.govCritical 9.4
A remote attacker may be able to bypass access control of Commend WS203VICM by creating a malicious request.
- Product
- WS203VICM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclibrary-online.commend.comcisa.gov
Feb 20, 2024A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.06.01.CVE-2023-39541 · Other software · Silicon Labs · reported by talos-cna@cisco.comMedium 5.9
A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted network packet can lead to an out-of-bounds read. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability concerns a denial of service within the parsing an IPv6 ICMPv6 packet.
- Product
- Gecko Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Feb 20, 2024A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.06.01.CVE-2023-39540 · Other software · Silicon Labs · reported by talos-cna@cisco.comMedium 5.9
A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted network packet can lead to an out-of-bounds read. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability concerns a denial of service within the parsing an IPv4 ICMP packet.
- Product
- Gecko Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Feb 2, 2024Cross-site scripting (XSS) vulnerability in XunRuiCMS versions v4.6.2 and before, allows remote attackers to obtain sensitive information via crafted malicious CVE-2024-24388 · Other software · Xunruicms · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in XunRuiCMS versions v4.6.2 and before, allows remote attackers to obtain sensitive information via crafted malicious requests to the background login.
- Product
- Xunruicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcnblogs.comcnblogs.com
Jan 16, 2024A vulnerability classified as critical has been found in ZhiCms up to 4.0.CVE-2024-0603 · Other software · Zhicms · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in ZhiCms up to 4.0. This affects an unknown part of the file app/plug/controller/giftcontroller.php. The manipulation of the argument mylike leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250839.
- Product
- Zhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 10, 2024Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the $keywords parameter at /core/admin/copyfrom.php.CVE-2023-52064 · Other software · Wuzhicms · reported by MITRECritical 9.8
Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the $keywords parameter at /core/admin/copyfrom.php.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 8, 2024Under certain conditions, Internet Communication Manager (ICM) or SAP Web Dispatcher - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC 7CVE-2024-22124 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.1
Under certain conditions, Internet Communication Manager (ICM) or SAP Web Dispatcher - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22_EXT, WEBDISP 7.22_EXT, WEBDISP 7.53, WEBDISP 7.54, could allow an attacker to access information which would otherwise be restricted causing high impact on confidentiality.
- Product
- SAP NetWeaver (Internet Communication Manager)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2024Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the component /admin/c/PluginsController.php.CVE-2023-51154 · Other software · Jizhicms · reported by MITRECritical 9.8
Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the component /admin/c/PluginsController.php.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2023File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to the download_url parCVE-2023-50692 · Other software · Jizhicms · reported by MITREHigh 8.8
File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to the download_url parameter in the app/admin/exts/ directory.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2023An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code onCVE-2023-32727 · Other software · Zabbix · reported by security@zabbix.comMedium 6.8
An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.zabbix.comlists.debian.org
Dec 14, 2023PopojiCMS version 2.0.1 is vulnerable to remote command execution in the Meta Social field.CVE-2023-50011 · Other software · Popojicms · reported by MITREHigh 7.2
PopojiCMS version 2.0.1 is vulnerable to remote command execution in the Meta Social field.
- Product
- Popojicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Dec 11, 2023XunRuiCMS v4.5.5 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin.php.CVE-2023-49490 · Other software · Xunruicms · reported by MITREMedium 6.1
XunRuiCMS v4.5.5 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin.php.
- Product
- Xunruicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2023Chunghwa Telecom NOKIA G-040W-Q Firewall function has a vulnerability of input validation for ICMP redirect messages.CVE-2023-41355 · Other software · Chunghwa Telecom · reported by twcert@cert.org.twCritical 9.8
Chunghwa Telecom NOKIA G-040W-Q Firewall function has a vulnerability of input validation for ICMP redirect messages. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted package to modify the network routing table, resulting in a denial of service or sensitive information leaking.
- Product
- NOKIA G-040W-Q
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 3, 2023Chunghwa Telecom NOKIA G-040W-Q Firewall function does not block ICMP TIMESTAMP requests by default, an unauthenticated remote attacker can exploit this vulneraCVE-2023-41354 · Other software · Chunghwa Telecom · reported by twcert@cert.org.twMedium 4
Chunghwa Telecom NOKIA G-040W-Q Firewall function does not block ICMP TIMESTAMP requests by default, an unauthenticated remote attacker can exploit this vulnerability by sending a crafted package, resulting in partially sensitive information exposed to an actor.
- Product
- NOKIA G-040W-Q
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 1, 2023A vulnerability was found in PopojiCMS 2.0.1 and classified as problematic.CVE-2023-5910 · Other software · Popojicms · reported by VulDBLow 2.6
A vulnerability was found in PopojiCMS 2.0.1 and classified as problematic. This issue affects some unknown processing of the file install.php of the component Web Config. The manipulation of the argument Site Title with the input <script>alert(1)</script> leads to cross site scripting. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-244229 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Popojicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2023SQL injection vulnerability in wuzhicms v.4.1.0 allows a remote attacker to execute arbitrary code via the Database Backup Functionality in the coreframe/app/daCVE-2023-46482 · Other software · Wuzhicms · reported by MITRECritical 9.8
SQL injection vulnerability in wuzhicms v.4.1.0 allows a remote attacker to execute arbitrary code via the Database Backup Functionality in the coreframe/app/database/admin/index.php component.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2023A vulnerability in ICMPv6 inspection when configured with the Snort 2 detection engine for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenCVE-2023-20083 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.6
A vulnerability in ICMPv6 inspection when configured with the Snort 2 detection engine for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the CPU of an affected device to spike to 100 percent, which could stop all traffic processing and result in a denial of service (DoS) condition. FTD management traffic is not affected by this vulnerability. This vulnerability is due to improper error checking when parsing fields within the ICMPv6 header. An attacker could exploit this vulnerability by sending a crafted ICMPv6 packet through an affected device. A successful exploit could allow the attacker to cause the device to exhaust CPU resources and stop processing traffic, resulting in a DoS condition. Note: To recover from the DoS condition, the Snort 2 Detection Engine or the Cisco FTD device may need to be restarted.
- Product
- Cisco Firepower Threat Defense Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Nov 1, 2023A vulnerability in ICMPv6 processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthCVE-2023-20086 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.6
A vulnerability in ICMPv6 processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper processing of ICMPv6 messages. An attacker could exploit this vulnerability by sending crafted ICMPv6 messages to a targeted Cisco ASA or FTD system with IPv6 enabled. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
- Product
- Cisco Adaptive Security Appliance (ASA) Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Oct 31, 2023Stored Cross Site Scripting (XSS) vulnerability in MiniCMS 1.1.1 allows attackers to run arbitrary code via crafted string appended to /mc-admin/conf.php.CVE-2023-46378 · Other software · 1234n · reported by MITREMedium 5.4
Stored Cross Site Scripting (XSS) vulnerability in MiniCMS 1.1.1 allows attackers to run arbitrary code via crafted string appended to /mc-admin/conf.php.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023Insecure Permissions vulnerability in WenwenaiCMS v.1.0 allows a remote attacker to escalate privileges.CVE-2023-45990 · Other software · Wenwen-ai · reported by MITREHigh 8
Insecure Permissions vulnerability in WenwenaiCMS v.1.0 allows a remote attacker to escalate privileges.
- Product
- Wenwenai CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2023A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules.CVE-2023-5366 · Other software · Red Hat · reported by Red HatHigh 7.1
A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may allow a local attacker to create specially crafted packets with a modified or spoofed target IP address field that can redirect ICMPv6 traffic to arbitrary IP addresses.
- Product
- Fast Datapath for RHEL 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comaccess.redhat.com
Oct 2, 2023There is a SQL injection vulnerability in the Jizhicms 2.4.9 backend, which users can use to obtain database informationCVE-2023-43836 · Other software · Jizhicms · reported by MITREMedium 6.5
There is a SQL injection vulnerability in the Jizhicms 2.4.9 backend, which users can use to obtain database information
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 27, 2023xunruicms up to v4.5.1 was discovered to contain a remote code execution (RCE) vulnerability in /index.php.CVE-2021-38243 · Other software · Xunruicms · reported by MITRECritical 9.8
xunruicms up to v4.5.1 was discovered to contain a remote code execution (RCE) vulnerability in /index.php. This vulnerability allows attackers to execute arbitrary code via a crafted GET request.
- Product
- Xunruicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023Insecure Permissions vulnerability in icmsdev iCMS v.7.0.16 allows a remote attacker to obtain sensitive information.CVE-2023-42322 · Other software · Icmsdev · reported by MITRECritical 9.8
Insecure Permissions vulnerability in icmsdev iCMS v.7.0.16 allows a remote attacker to obtain sensitive information.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comicmsdev.com
Sep 20, 2023Cross Site Request Forgery (CSRF) vulnerability in icmsdev iCMSv.7.0.16 allows a remote attacker to execute arbitrary code via the user.admincp.php, members.admCVE-2023-42321 · Other software · Icmsdev · reported by MITREHigh 8.8
Cross Site Request Forgery (CSRF) vulnerability in icmsdev iCMSv.7.0.16 allows a remote attacker to execute arbitrary code via the user.admincp.php, members.admincp.php, and group.admincp.php files.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comicmsdev.com
Sep 12, 2023 SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1.CVE-2023-4928 · Other software · instantsoft · reported by security@huntr.devHigh 7.2
SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2023Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1.-git.CVE-2023-4879 · Other software · instantsoft · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1.-git.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2023Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-4878 · Other software · instantsoft · reported by security@huntr.devMedium 5.4
Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2023icms 7.0.16 is vulnerable to Cross Site Request Forgery (CSRF).CVE-2023-40953 · Other software · Idreamsoft · reported by MITREHigh 8.8
icms 7.0.16 is vulnerable to Cross Site Request Forgery (CSRF).
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comicmsdev.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.