Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
420 results · page 5 of 9
Feb 13, 2023An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code.CVE-2023-25240 · Other software · Pimcore · reported by MITREHigh 8.8
An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code.
- Product
- Pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comportswigger.net
Feb 6, 2023pycdc commit 44a730f3a889503014fec94ae6e62d8401cb75e5 was discovered to contain a stack overflow via the component ASTree.cpp:BuildFromCode.CVE-2022-48078 · Other software · Pycdc Project · reported by MITRECritical 9.8
pycdc commit 44a730f3a889503014fec94ae6e62d8401cb75e5 was discovered to contain a stack overflow via the component ASTree.cpp:BuildFromCode.
- Product
- Pycdc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce.CVE-2023-23937 · Other software · pimcore · reported by GitHubHigh 8.2
Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. The upload functionality for updating user profile does not properly validate the file content-type, allowing any authenticated user to bypass this security check by adding a valid signature (p.e. GIF89) and sending any invalid content-type. This could allow an authenticated attacker to upload HTML files with JS content that will be executed in the context of the domain. This issue has been patched in version 10.5.16.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.14.CVE-2023-0323 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.14.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2022Pimcore is an open source data and experience management platform.CVE-2022-39365 · Other software · pimcore · reported by GitHubCritical 9.8
Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig templates rendering in `Pimcore/Mail` & `ClassDefinition\Layout\Text` is vulnerable to server-side template injection, which could lead to remote code execution. Version 10.5.9 contains a patch for this issue. As a workaround, one may apply the patch manually.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022Due to lack of proper memory management, when a victim opens manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) file received from untrusted sources in CVE-2022-41186 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.8
Due to lack of proper memory management, when a victim opens manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, a Remote Code Execution can be triggered when payload forces a stack-based overflow and or a re-use of dangling pointer which refers to overwritten space in memory.
- Product
- SAP 3D Visual Enterprise Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Sep 21, 2022If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user.CVE-2022-3255 · Other software · pimcore · reported by security@huntr.devMedium 4.8
If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is able to view. Modify any information that the user is able to modify. Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2022Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.6.CVE-2022-3211 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.6.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2022D-Link DIR-816 A2_v1.10CNB04.img is vulnerable to Command Injection via /goform/SystemCommand.CVE-2022-37129 · Other software · Dlink · reported by MITREHigh 8.8
D-Link DIR-816 A2_v1.10CNB04.img is vulnerable to Command Injection via /goform/SystemCommand. After the user passes in the command parameter, it will be spliced into byte_4836B0 by snprintf, and finally doSystem(&byte_4836B0); will be executed, resulting in a command injection.
- Product
- Dir-816 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2022Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.4.CVE-2022-2796 · Other software · pimcore · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.4.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2022Improper restriction of broadcasting Intent in ConfirmConnectActivity of?NFC prior to SMR Aug-2022 Release 1 leaks MAC address of the connected Bluetooth deviceCVE-2022-33729 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.9
Improper restriction of broadcasting Intent in ConfirmConnectActivity of?NFC prior to SMR Aug-2022 Release 1 leaks MAC address of the connected Bluetooth device.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jul 18, 2022The component mcontrol.action in RISCV ISA Sim commit ac466a21df442c59962589ba296c702631e041b5 contains the incorrect mask which can cause a Denial of Service (CVE-2022-34642 · Other software · Riscv · reported by MITREMedium 5.5
The component mcontrol.action in RISCV ISA Sim commit ac466a21df442c59962589ba296c702631e041b5 contains the incorrect mask which can cause a Denial of Service (DoS).
- Product
- Spike Risc-v ISA Simulator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2022NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmmCore, where a user with high privileges can chain another vulnerability to this vulnerability, causiCVE-2022-31600 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.5
NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmmCore, where a user with high privileges can chain another vulnerability to this vulnerability, causing an integer overflow, possibly leading to code execution, escalation of privileges, denial of service, compromised integrity, and information disclosure. The scope of impact can extend to other components.
- Product
- NVIDIA DGX A100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Jun 30, 2022In a openshift node, there is a cron job to update mcollective facts that mishandles a temporary file.CVE-2013-4561 · Other software · Redhat · reported by Red HatCritical 9.1
In a openshift node, there is a cron job to update mcollective facts that mishandles a temporary file. This may lead to loss of confidentiality and integrity.
- Product
- Openshift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgithub.com
Jun 29, 2022CVA6 commit 909d85a accesses invalid memory when reading the value of MHPMCOUNTER30.CVE-2022-33021 · Other software · Openhwgroup · reported by MITREHigh 7.5
CVA6 commit 909d85a accesses invalid memory when reading the value of MHPMCOUNTER30.
- Product
- Cva6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022Pimcore is an Open Source Data & Experience Management Platform.CVE-2022-31092 · Other software · pimcore · reported by GitHubHigh 7.5
Pimcore is an Open Source Data & Experience Management Platform. Pimcore offers developers listing classes to make querying data easier. This listing classes also allow to order or group the results based on one or more columns which should be quoted by default. The actual issue is that quoting is not done properly in both cases, so there's the theoretical possibility to inject custom SQL if the developer is using this methods with input data and not doing proper input validation in advance and so relies on the auto-quoting being done by the listing classes. This issue has been resolved in version 10.4.4. Users are advised to upgrade or to apple the patch manually. There are no known workarounds for this issue.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2022Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_vmcode_interpreter at src/njs_vmcode.c.CVE-2022-32414 · Network & remote access · F5 · reported by MITREMedium 5.5
Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_vmcode_interpreter at src/njs_vmcode.c.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022When a user opens manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the appliCVE-2022-32237 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.5
When a user opens manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.
- Product
- SAP 3D Visual Enterprise Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Jun 13, 2022The kernel emcom module has multi-thread contention.CVE-2022-31751 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
The kernel emcom module has multi-thread contention. Successful exploitation of this vulnerability may affect system availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
May 23, 2022Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check.CVE-2022-28944 · Other software · Emcosoftware · reported by MITREHigh 8.8
Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check. This affects MSI Package Builder for Windows 9.1.4 and Remote Installer for Windows 6.0.13 and Ping Monitor for Windows 8.0.18 and Remote Shutdown for Windows 7.2.2 and WakeOnLan 2.0.8 and Network Inventory for Windows 5.8.22 and Network Software Scanner for Windows 2.0.8 and UnLock IT for Windows 6.1.1. The impact is: execute arbitrary code (remote). The component is: Updater. The attack vector is: To exploit this vulnerability, a user must trigger an update of an affected installation of EMCO Software. ¶¶ Multiple products from EMCO Software are affected by a remote code execution vulnerability during the update process.
- Product
- MSI Package Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2022A Time of Check Time of Use (TOCTOU) vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, prior to version 1.CVE-2021-3969 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.8
A Time of Check Time of Use (TOCTOU) vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, prior to version 1.1.20.3that could allow a local attacker to elevate privileges.
- Product
- IMController
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
May 18, 2022A race condition vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, prior to version 1.1.20.3 that could alCVE-2021-3922 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.8
A race condition vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, prior to version 1.1.20.3 that could allow a local attacker to connect and interact with the IMController child process' named pipe.
- Product
- IMController
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Apr 22, 2022SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6.CVE-2022-1429 · Other software · pimcore · reported by security@huntr.devHigh 7.5
SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6. This vulnerability is capable of steal the data
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2022NGINX NJS 0.7.2 was discovered to contain a NULL pointer dereference via the component njs_vmcode_array at /src/njs_vmcode.c.CVE-2022-28049 · Network & remote access · F5 · reported by MITREMedium 5.5
NGINX NJS 0.7.2 was discovered to contain a NULL pointer dereference via the component njs_vmcode_array at /src/njs_vmcode.c.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022Stored XSS in Tooltip in GitHub repository pimcore/pimcore prior to 10.4.CVE-2022-1351 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Stored XSS in Tooltip in GitHub repository pimcore/pimcore prior to 10.4.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022SQL injection in ElementController.php in GitHub repository pimcore/pimcore prior to 10.3.5.CVE-2022-1339 · Other software · pimcore · reported by security@huntr.devHigh 7.5
SQL injection in ElementController.php in GitHub repository pimcore/pimcore prior to 10.3.5. This vulnerability is capable of steal the data
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2022When a user opens a manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0,CVE-2022-26106 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.5
When a user opens a manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application.
- Product
- SAP 3D Visual Enterprise Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Apr 8, 2022SQL injection in RecyclebinController.php in GitHub repository pimcore/pimcore prior to 10.3.5.CVE-2022-1219 · Other software · pimcore · reported by security@huntr.devHigh 7.5
SQL injection in RecyclebinController.php in GitHub repository pimcore/pimcore prior to 10.3.5. This vulnerability is capable of steal the data
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2022Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/data-hub prior to 1.2.4.CVE-2022-0955 · Other software · pimcore · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/data-hub prior to 1.2.4.
- Product
- pimcore/data-hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2022The matchmaking servers of Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allow remote attackers to send arbitrary push requests to clients via a RCVE-2022-24125 · Other software · Fromsoftware · reported by MITREHigh 8.8
The matchmaking servers of Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allow remote attackers to send arbitrary push requests to clients via a RequestSendMessageToPlayers request. For example, ability to send a push message to hundreds of thousands of machines is only restricted on the client side, and can thus be bypassed with a modified client.
- Product
- Dark Souls III
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfromsoftware.jpgithub.com
Mar 19, 2022A buffer overflow in the NRSessionSearchResult parser in Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allows remote attackers to execute arbitrarCVE-2022-24126 · Other software · Fromsoftware · reported by MITRECritical 9.8
A buffer overflow in the NRSessionSearchResult parser in Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allows remote attackers to execute arbitrary code via matchmaking servers, a different vulnerability than CVE-2021-34170.
- Product
- Dark Souls III
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfromsoftware.jpgithub.com
Mar 16, 2022Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.CVE-2022-0705 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2022Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.CVE-2022-0704 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2022Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.CVE-2022-0911 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.CVE-2022-0894 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.CVE-2022-0893 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2022Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.CVE-2022-0832 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2022Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.CVE-2022-0831 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2022Path Traversal in GitHub repository pimcore/pimcore prior to 10.3.2.CVE-2022-0665 · Other software · pimcore · reported by security@huntr.devMedium 6.5
Path Traversal in GitHub repository pimcore/pimcore prior to 10.3.2.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njs_vmcode_typeof in /src/njs_vmcode.c.CVE-2021-46461 · Websites & servers · Nginx · reported by MITRECritical 9.8
njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njs_vmcode_typeof in /src/njs_vmcode.c.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022Cross-site Scripting in Packagist pimcore/pimcore prior to 10.3.1.CVE-2022-0565 · Other software · pimcore · reported by security@huntr.devHigh 7.6
Cross-site Scripting in Packagist pimcore/pimcore prior to 10.3.1.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2022Cross-site Scripting (XSS) - Reflected in Packagist pimcore/pimcore prior to 10.3.1.CVE-2022-0510 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in Packagist pimcore/pimcore prior to 10.3.1.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2022Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.3.1.CVE-2022-0509 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.3.1.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2022Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set to be sent to each rCVE-2022-0474 · Other software · OTRS AG · reported by security@otrs.comLow 2.4
Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set to be sent to each recipient individually. This issue affects: OTRS AG OTRSCustomContactFields 8.0.x version: 8.0.11 and prior versions.
- Product
- OTRSCustomContactFields
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.CVE-2022-0348 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2022Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.10.CVE-2022-0251 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.10.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2022Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.9.CVE-2022-0285 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.9.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7.CVE-2022-0263 · Other software · pimcore · reported by security@huntr.devHigh 7.8
Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.7.CVE-2022-0262 · Other software · pimcore · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.7.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022Business Logic Errors in GitHub repository pimcore/pimcore prior to 10.2.6.CVE-2021-4146 · Other software · pimcore · reported by security@huntr.devMedium 4.3
Business Logic Errors in GitHub repository pimcore/pimcore prior to 10.2.6.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.