Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
409 results · page 5 of 9
Aug 9, 2022The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function.CVE-2022-25907 · Other software · Typescript Deep Merge Project · reported by report@snyk.ioHigh 7.5
The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function.
- Product
- Typescript Deep Merge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2022All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function.CVE-2021-23397 · Other software · Merge Project · reported by report@snyk.ioMedium 5.6
All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @generates/merger instead.
- Product
- Merge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.snyk.iosecurity.snyk.io
Jun 30, 2022Jenkins Jigomerge Plugin 0.9 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with ECVE-2022-34806 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins Jigomerge Plugin 0.9 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
- Product
- Jenkins Jigomerge Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2022github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests (PRs).CVE-2022-29220 · Other software · fastify · reported by GitHubMedium 6.5
github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests (PRs). Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set to `dependabot[bot]` to determine if the PR is a legit PR. Theoretically, an owner of a seemingly valid and legit action in the pipeline can check if the PR is created by dependabot and if their own action has enough permissions to modify the PR in the pipeline. If so, they can modify the PR by adding a second seemingly valid and legit commit to the PR, as they can set arbitrarily the username and email in for commits in git. Because the bot only checks if the actor is valid, it would pass the malicious changes through and merge the PR automatically, without getting noticed by project maintainers. It would probably not be possible to determine where the malicious commit came from, as it would only say `dependabot[bot]` and the corresponding email-address. Version 3.2.0 contains a patch for this issue.
- Product
- github-action-merge-dependabot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2022In telephony, there is a possible way to disable receiving emergency broadcasts due to a missing permission check.CVE-2022-20084 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comHigh 7.8
In telephony, there is a possible way to disable receiving emergency broadcasts due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06498874; Issue ID: ALPS06498874.
- Product
- MT6731, MT6732, MT6735, MT6737, MT6739, MT6750, MT6750S, MT6752, MT6753, MT6755, MT6755S, MT6757, MT6757C, MT6757CD, MT6757CH, MT6758, MT6761, MT6762, MT6763, M
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
May 1, 2022All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if tCVE-2022-25645 · Other software · Dset Project · reported by report@snyk.ioMedium 6.5
All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains __proto__, constructor or protorype. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution.
- Product
- Dset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2022The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes CVE-2022-24279 · Other software · Springtree · reported by report@snyk.ioHigh 7.5
The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix of [CVE-2020-7701](https://security.snyk.io/vuln/SNYK-JS-MADLIBOBJECTUTILS-598676)
- Product
- Madlib-object-utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects.CVE-2022-24802 · Other software · RebeccaStevens · reported by GitHubHigh 8.1
deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. deepmerge-ts is vulnerable to Prototype Pollution via file deepmerge.ts, function defaultMergeRecords(). This issue has been patched in version 4.0.2. There are no known workarounds for this issue.
- Product
- deepmerge-ts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2022The package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it.CVE-2022-25354 · Other software · Set-in Project · reported by report@snyk.ioHigh 8.6
The package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-28273](https://security.snyk.io/vuln/SNYK-JS-SETIN-1048049)
- Product
- Set-in
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into CVE-2021-23507 · Other software · Skratchdot · reported by report@snyk.ioHigh 7.5
The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-OBJECTPATHSET-607908
- Product
- Object-path-set
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022This affects the package putil-merge before 3.8.0.CVE-2021-23470 · Other software · Putil-merge Project · reported by report@snyk.ioHigh 8.2
This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077
- Product
- Putil-merge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2022In sortSimPhoneAccountsForEmergency of CreateConnectionProcessor.java, there is a possible prevention of access to emergency calling due to an unhandled exceptiCVE-2021-39659 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In sortSimPhoneAccountsForEmergency of CreateConnectionProcessor.java, there is a possible prevention of access to emergency calling due to an unhandled exception. In rare instances, this could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-208267659
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jan 10, 2022The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge.CVE-2021-23568 · Other software · Eggjs · reported by report@snyk.ioHigh 7.3
The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge.
- Product
- Extend2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2021All versions of package merge-deep2 are vulnerable to Prototype Pollution via the mergeDeep() function.CVE-2021-23700 · Other software · Merge-deep2 Project · reported by report@snyk.ioMedium 6.5
All versions of package merge-deep2 are vulnerable to Prototype Pollution via the mergeDeep() function.
- Product
- Merge-deep2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2021All versions of package sey are vulnerable to Prototype Pollution via the deepmerge() function.CVE-2021-23663 · Other software · SEY Project · reported by report@snyk.ioMedium 6.5
All versions of package sey are vulnerable to Prototype Pollution via the deepmerge() function.
- Product
- SEY
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2021All versions of package comb are vulnerable to Prototype Pollution via the deepMerge() function.CVE-2021-23561 · Other software · C2fo · reported by report@snyk.ioMedium 6.5
All versions of package comb are vulnerable to Prototype Pollution via the deepMerge() function.
- Product
- Comb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2021The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParamCVE-2021-23433 · Other software · Algolia · reported by report@snyk.ioMedium 5.9
The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters._parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the implementation allows users to define arbitrary search patterns.
- Product
- Algoliasearch-helper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021A Stored XSS in merge request creation page in all versions of Gitlab EE starting from 13.7 before 14.1.7, all versions starting from 14.2 before 14.2.5, and alCVE-2021-39885 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 8.7
A Stored XSS in merge request creation page in all versions of Gitlab EE starting from 13.7 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 allows an attacker to execute arbitrary JavaScript code on the victim's behalf via malicious approval rule names
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2021merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2021-3645 · Other software · viking04 · reported by security@huntr.devCritical 9.8
merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- Product
- viking04/merge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021A crafted NTFS image can cause an out-of-bounds read in ntfs_runlists_merge_i in NTFS-3G < 2021.8.22.CVE-2021-39253 · Other software · Tuxera · reported by MITREHigh 7.8
A crafted NTFS image can cause an out-of-bounds read in ntfs_runlists_merge_i in NTFS-3G < 2021.8.22.
- Product
- Ntfs-3g
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2021LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM.CVE-2021-3693 · Other software · ledgersmb · reported by security@huntr.devHigh 8.8
LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.
- Product
- ledgersmb/ledgersmb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhuntr.devledgersmb.org
Aug 11, 2021All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function.CVE-2021-23421 · Other software · Merge-change Project · reported by report@snyk.ioMedium 5.6
All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function.
- Product
- Merge-change
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2021All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.CVE-2021-23417 · Other software · Deepmergefn Project · reported by report@snyk.ioMedium 5.6
All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.
- Product
- Deepmergefn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2021Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code executioCVE-2021-25953 · Other software · Putil-merge Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution.
- Product
- Putil-merge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwhitesourcesoftware.comwhitesourcesoftware.com
Jul 7, 2021Improper code rendering while rendering merge requests could be exploited to submit malicious code.CVE-2021-22230 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.9
Improper code rendering while rendering merge requests could be exploited to submit malicious code. This vulnerability affects GitLab CE/EE 9.3 and later through 13.11.6, 13.12.6, and 14.0.2.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2021All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.CVE-2021-23403 · Other software · Ts-nodash Project · reported by report@snyk.ioHigh 7.3
All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.
- Product
- Ts-nodash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2021In onCreate of EmergencyCallbackModeExitDialog.java, there is a possible exit of emergency callback mode due to a tapjacking/overlay attack.CVE-2021-0538 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.3
In onCreate of EmergencyCallbackModeExitDialog.java, there is a possible exit of emergency callback mode due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-178821491
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 17, 2021All versions of package lutils are vulnerable to Prototype Pollution via the main (merge) function.CVE-2021-23396 · Other software · Lutils Project · reported by report@snyk.ioMedium 5.6
All versions of package lutils are vulnerable to Prototype Pollution via the main (merge) function.
- Product
- Lutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2021Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'CVE-2021-30641 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'
- Product
- Apache HTTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhttpd.apache.orgopenwall.com
Jun 2, 2021The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it.CVE-2021-26707 · Other software · Merge-deep Project · reported by MITRECritical 9.8
The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library.
- Product
- Merge-deep
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
May 3, 2021In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions.CVE-2021-28860 · Other software · Adaltas · reported by MITRECritical 9.1
In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).
- Product
- Mixme
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2021The MergeTrack function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.CVE-2021-31260 · Other software · Gpac · reported by MITREMedium 5.5
The MergeTrack function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2021NULL Pointer Dereference in the "isomedia/track.c" module's "MergeTrack()" function of GPAC v0.5.2 allows attackers to execute arbitrary code or cause a Denial-CVE-2021-28300 · Other software · Gpac · reported by MITRECritical 9.8
NULL Pointer Dereference in the "isomedia/track.c" module's "MergeTrack()" function of GPAC v0.5.2 allows attackers to execute arbitrary code or cause a Denial-of-Service (DoS) by uploading a malicious MP4 file.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2021In injectBestLocation and handleUpdateLocation of GnssLocationProvider.java, there is a possible incorrect reporting of location data to emergency services due CVE-2021-0400 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In injectBestLocation and handleUpdateLocation of GnssLocationProvider.java, there is a possible incorrect reporting of location data to emergency services due to improper input validation. This could lead to incorrect reporting of location data to emergency services with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11Android ID: A-177561690
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 16, 2021Prototype pollution vulnerability in 'patchmerge' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execuCVE-2021-25916 · Other software · Patchmerge Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'patchmerge' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
- Product
- Patchmerge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Feb 18, 2021All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .CVE-2020-28499 · Other software · Merge Project · reported by report@snyk.ioHigh 7.3
All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .
- Product
- Merge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2021A vulnerability in the audit logging component of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco UCVE-2021-1226 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in the audit logging component of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, Cisco Unity Connection, Cisco Emergency Responder, and Cisco Prime License Manager could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. The vulnerability is due to the storage of certain unencrypted credentials. An attacker could exploit this vulnerability by accessing the audit logs on an affected system and obtaining credentials that they may not normally have access to. A successful exploit could allow the attacker to use those credentials to discover and manage network devices.
- Product
- Cisco Emergency Responder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Dec 11, 2020lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property (e.g., __proto__) can be copied during a merge or clone operation.CVE-2020-35149 · Other software · Mquery Project · reported by MITREMedium 5.3
lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property (e.g., __proto__) can be copied during a merge or clone operation.
- Product
- Mquery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2020Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tagCVE-2020-29456 · Other software · Papermerge · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document's filename. If email consumption is configured in Papermerge, a malicious document can be sent by email and is automatically uploaded into the Papermerge web application. Therefore, no authentication is required to exploit XSS if email consumption is configured. Otherwise authentication is required.
- Product
- Papermerge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2020Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code exCVE-2020-28268 · Other software · Controlled-merge Project · reported by vulnerabilitylab@mend.ioHigh 7.5
Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution.
- Product
- Controlled-merge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Nov 9, 2020Prototype pollution vulnerability in json8-merge-patch npm package < 1.0.3 may allow attackers to inject or modify methods and properties of the global object cCVE-2020-8268 · Other software · Json8-merge-patch Project · reported by support@hackerone.comHigh 7.5
Prototype pollution vulnerability in json8-merge-patch npm package < 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor.
- Product
- Json8-merge-patch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Oct 22, 2020A cross-site scripting (XSS) vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6.CVE-2020-27642 · Other software · Bigbluebutton · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6.
- Product
- Greenlight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2020A vulnerability in the web framework of Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack aCVE-2019-16025 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.8
A vulnerability in the web framework of Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of some parameters that are passed to the web server of the affected software. An attacker could exploit this vulnerability by persuading a user to access a malicious link or by intercepting a user request for the affected web interface and injecting malicious code into that request. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected web-based management interface or access sensitive, browser-based information.
- Product
- Cisco Emergency Responder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Sep 17, 2020In showNotification of EmergencyCallbackModeService.java, there is a possible permission bypass due to an unsafe PendingIntent.CVE-2020-0395 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In showNotification of EmergencyCallbackModeService.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10 Android-11Android ID: A-154124307
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Sep 17, 2020In createEmergencyLocationUserNotification of GnssVisibilityControl.java, there is a possible permissions bypass due to an empty mutable PendingIntent.CVE-2020-0388 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In createEmergencyLocationUserNotification of GnssVisibilityControl.java, there is a possible permissions bypass due to an empty mutable PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-10Android ID: A-156123285
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Sep 1, 2020All versions of package gammautils are vulnerable to Prototype Pollution via the deepSet and deepMerge functions.CVE-2020-7718 · Other software · Gammautils Project · reported by report@snyk.ioCritical 9.8
All versions of package gammautils are vulnerable to Prototype Pollution via the deepSet and deepMerge functions.
- Product
- Gammautils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2020IBM Intelligent Operations Center for Emergency Management, Intelligent Operations Center (IOC), and IBM Water Operations for Waternamics are vulnerable to crosCVE-2020-4318 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Intelligent Operations Center for Emergency Management, Intelligent Operations Center (IOC), and IBM Water Operations for Waternamics are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 177356.
- Product
- Intelligent Operations Center for Emergency Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 28, 2020IBM Intelligent Operations Center for Emergency Management, Intelligent Operations Center (IOC), and IBM Water Operations for Waternamics are vulnerable to crosCVE-2020-4317 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Intelligent Operations Center for Emergency Management, Intelligent Operations Center (IOC), and IBM Water Operations for Waternamics are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 177355.
- Product
- Intelligent Operations Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 19, 2020In all versions of package casperjs, the mergeObjects utility function is susceptible to Prototype Pollution.CVE-2020-7679 · Other software · Casperjs · reported by report@snyk.ioHigh 7.3
In all versions of package casperjs, the mergeObjects utility function is susceptible to Prototype Pollution.
- Product
- Casperjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2020In Zammad before 3.3.1, a Customer has ticket access that should only be available to an Agent (e.g., read internal data, split, or merge).CVE-2020-14213 · Other software · Zammad · reported by MITREMedium 5.4
In Zammad before 3.3.1, a Customer has ticket access that should only be available to an Agent (e.g., read internal data, split, or merge).
- Product
- Zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.