Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
331 results · page 5 of 7
Mar 21, 2024In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload.CVE-2024-29859 · Other software · misp · reported by MITRECritical 9.8
In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload.
- Product
- misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload.CVE-2024-29858 · Other software · misp · reported by MITRECritical 9.8
In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload.
- Product
- misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024In the Linux kernel, the following vulnerability has been resolved: media: [next] staging: media: atomisp: fix memory leak of object flash In the case where tCVE-2020-36786 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: media: [next] staging: media: atomisp: fix memory leak of object flash In the case where the call to lm3554_platform_data_func returns an error there is a memory leak on the error return path of object flash. Fix this by adding an error return path that will free flash and rename labels fail2 to fail3 and fail1 to fail2.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Feb 28, 2024In the Linux kernel, the following vulnerability has been resolved: media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs() The "s3a_buf" is freedCVE-2020-36785 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs() The "s3a_buf" is freed along with all the other items on the "asd->s3a_stats" list. It leads to a double free and a use after free.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Feb 9, 2024An issue was discovered in MISP before 2.4.184.CVE-2024-25675 · Other software · Misp-project · reported by MITRECritical 9.8
An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/JobsController.php and app/View/Events/export.ctp.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2024An issue was discovered in MISP before 2.4.184.CVE-2024-25674 · Other software · misp · reported by MITRECritical 9.8
An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type.
- Product
- misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2023app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs.CVE-2023-50918 · Other software · Misp-project · reported by MITRECritical 9.8
app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2023app/Lib/Tools/EventTimelineTool.php in MISP before 2.4.179 allows XSS in the event timeline widget.CVE-2023-49926 · Other software · Misp-project · reported by MITREMedium 6.1
app/Lib/Tools/EventTimelineTool.php in MISP before 2.4.179 allows XSS in the event timeline widget.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2023An issue was discovered in MISP before 2.4.176.CVE-2023-48659 · Other software · Misp-project · reported by MITRECritical 9.8
An issue was discovered in MISP before 2.4.176. app/Controller/AppController.php mishandles parameter parsing.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2023An issue was discovered in MISP before 2.4.176.CVE-2023-48658 · Other software · Misp-project · reported by MITRECritical 9.8
An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php lacks a checkParam function for alphanumerics, underscore, dash, period, and space.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2023An issue was discovered in MISP before 2.4.176.CVE-2023-48657 · Other software · Misp-project · reported by MITRECritical 9.8
An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2023An issue was discovered in MISP before 2.4.176.CVE-2023-48656 · Other software · Misp-project · reported by MITRECritical 9.8
An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2023An issue was discovered in MISP before 2.4.176.CVE-2023-48655 · Other software · Misp-project · reported by MITRECritical 9.8
An issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly filter out query parameters.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2023An issue was discovered in MISP 2.4.174.CVE-2023-41098 · Other software · Misp-project · reported by MITREMedium 6.1
An issue was discovered in MISP 2.4.174. In app/Controller/DashboardsController.php, a reflected XSS issue exists via the id parameter upon a dashboard edit.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2023MISP 2.4.174 allows XSS in app/View/Events/index.ctp.CVE-2023-40224 · Other software · Misp-project · reported by MITREMedium 6.1
MISP 2.4.174 allows XSS in app/View/Events/index.ctp.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2023In MISP before 2.4.172, title_for_layout is not properly sanitized in Correlations, CorrelationExclusions, and Layouts.CVE-2023-37307 · Other software · Misp-project · reported by MITREMedium 5.4
In MISP before 2.4.172, title_for_layout is not properly sanitized in Correlations, CorrelationExclusions, and Layouts.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 30, 2023MISP 2.4.172 mishandles different certificate file extensions in server sync.CVE-2023-37306 · Other software · Misp-project · reported by MITREHigh 7.5
MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error messages.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsynacktiv.com
Jun 6, 2023Information disclosure in Kernel due to indirect branch misprediction.CVE-2022-40523 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.1
Information disclosure in Kernel due to indirect branch misprediction.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Mar 26, 2023In MISP 2.4.169, app/Lib/Tools/CustomPaginationTool.php allows XSS in the community index.CVE-2023-28884 · Other software · Misp-project · reported by MITREMedium 6.1
In MISP 2.4.169, app/Lib/Tools/CustomPaginationTool.php allows XSS in the community index.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2023js/event-graph.js in MISP before 2.4.169 allows XSS via the event-graph relationship tooltip.CVE-2023-28607 · Other software · Misp-project · reported by MITREMedium 6.1
js/event-graph.js in MISP before 2.4.169 allows XSS via the event-graph relationship tooltip.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2023js/event-graph.js in MISP before 2.4.169 allows XSS via event-graph node tooltips.CVE-2023-28606 · Other software · Misp-project · reported by MITREMedium 6.1
js/event-graph.js in MISP before 2.4.169 allows XSS via event-graph node tooltips.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2023MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, aCVE-2022-48329 · Other software · Misp-project · reported by MITRECritical 9.8
MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2023app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters.CVE-2022-48328 · Other software · Misp-project · reported by MITRECritical 9.8
app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2023app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field.CVE-2023-24070 · Other software · Misp-project · reported by MITREMedium 6.1
app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2023In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function.CVE-2023-24028 · Other software · Misp-project · reported by MITRECritical 9.8
In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2023In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name.CVE-2023-24027 · Other software · Misp-project · reported by MITREMedium 6.1
In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2023In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload.CVE-2023-24026 · Other software · Misp-project · reported by MITREMedium 6.1
In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022In MISP before 2.4.167, there is XSS in the template file uploads in app/View/Templates/upload_file.ctp.CVE-2022-47928 · Other software · Misp-project · reported by MITREMedium 6.1
In MISP before 2.4.167, there is XSS in the template file uploads in app/View/Templates/upload_file.ctp.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022Due to lack of proper memory management, when a victim opens a manipulated Right Hemisphere Binary (.rh, rh.x3d) file received from untrusted sources in SAP 3D CVE-2022-41201 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.8
Due to lack of proper memory management, when a victim opens a manipulated Right Hemisphere Binary (.rh, rh.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
- Product
- SAP 3D Visual Enterprise Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Oct 11, 2022Due to lack of proper memory management, when a victim opens manipulated Right Hemisphere Material (.rhm, rh.x3d) file received from untrusted sources in SAP 3DCVE-2022-41174 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.5
Due to lack of proper memory management, when a victim opens manipulated Right Hemisphere Material (.rhm, rh.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Author - version 9, it is possible for the application to crash and becomes temporarily unavailable to the user until restart of the application.
- Product
- SAP 3D Visual Enterprise Author
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Oct 10, 2022app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names (this is information that only the site admin should have).CVE-2022-42724 · Other software · Misp-project · reported by MITREMedium 4.3
app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names (this is information that only the site admin should have).
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2022An issue was discovered in MISP before 2.4.158.CVE-2022-29534 · Other software · Misp-project · reported by MITREHigh 7.5
An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/json" header.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2022An issue was discovered in MISP before 2.4.158.CVE-2022-29533 · Other software · Misp-project · reported by MITREMedium 6.1
An issue was discovered in MISP before 2.4.158. There is XSS in app/Controller/OrganisationsController.php in a situation with a "weird single checkbox page."
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2022An issue was discovered in MISP before 2.4.158.CVE-2022-29532 · Other software · Misp-project · reported by MITREMedium 4.8
An issue was discovered in MISP before 2.4.158. There is XSS in the cerebrate view if one administrator puts a javascript: URL in the URL field, and another administrator clicks on it.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2022An issue was discovered in MISP before 2.4.158.CVE-2022-29531 · Other software · Misp-project · reported by MITREMedium 5.4
An issue was discovered in MISP before 2.4.158. There is stored XSS in the event graph via a tag name.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2022An issue was discovered in MISP before 2.4.158.CVE-2022-29530 · Other software · Misp-project · reported by MITREMedium 5.4
An issue was discovered in MISP before 2.4.158. There is stored XSS in the galaxy clusters.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2022An issue was discovered in MISP before 2.4.158.CVE-2022-29529 · Other software · Misp-project · reported by MITREMedium 5.4
An issue was discovered in MISP before 2.4.158. There is stored XSS via the LinOTP login field.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2022An issue was discovered in MISP before 2.4.158.CVE-2022-29528 · Other software · Misp-project · reported by MITRECritical 9.8
An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2022An issue was discovered in MISP before 2.4.156.CVE-2022-27246 · Other software · Misp-project · reported by MITREMedium 6.1
An issue was discovered in MISP before 2.4.156. An SVG org logo (which may contain JavaScript) is not forbidden by default.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2022An issue was discovered in MISP before 2.4.156.CVE-2022-27245 · Other software · Misp-project · reported by MITREHigh 8.8
An issue was discovered in MISP before 2.4.156. app/Model/Server.php does not restrict generateServerSettings to the CLI. This could lead to SSRF.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2022An issue was discovered in MISP before 2.4.156.CVE-2022-27244 · Other software · Misp-project · reported by MITREMedium 4.8
An issue was discovered in MISP before 2.4.156. A malicious site administrator could store an XSS payload in the custom auth name. This would be executed each time the administrator modifies a user.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2022An issue was discovered in MISP before 2.4.156.CVE-2022-27243 · Other software · Misp-project · reported by MITREHigh 7.8
An issue was discovered in MISP before 2.4.156. app/View/Users/terms.ctp allows Local File Inclusion via the custom terms file setting.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022Spectre BHB is a variant of Spectre-v2 in which malicious code uses the shared branch history (stored in the CPU BHB) to influence mispredicted branches in the CVE-2022-25368 · Other software · Amperecomputing · reported by MITREMedium 4.7
Spectre BHB is a variant of Spectre-v2 in which malicious code uses the shared branch history (stored in the CPU BHB) to influence mispredicted branches in the victim's hardware context. Speculation caused by these mispredicted branches can then potentially be used to cause cache allocation, which can then be used to infer information that should be protected.
- Product
- Ampere Altra MAX Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordamperecomputing.comcve.mitre.org
Sep 17, 2021In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call.CVE-2021-41326 · Other software · Misp-project · reported by MITRECritical 9.8
In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2021MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value.CVE-2021-39302 · Other software · Misp-project · reported by MITRECritical 9.8
MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2021app/View/GalaxyElements/ajax/index.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster elements in JSON format.CVE-2021-37743 · Other software · Misp-project · reported by MITREMedium 5.4
app/View/GalaxyElements/ajax/index.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster elements in JSON format.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2021app/View/Elements/GalaxyClusters/view_relation_tree.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster relationships.CVE-2021-37742 · Other software · Misp-project · reported by MITREMedium 5.4
app/View/Elements/GalaxyClusters/view_relation_tree.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster relationships.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2021app/View/GalaxyClusters/add.ctp in MISP 2.4.146 allows Stored XSS when forking a galaxy cluster.CVE-2021-37534 · Other software · Misp-project · reported by MITREMedium 5.4
app/View/GalaxyClusters/add.ctp in MISP 2.4.146 allows Stored XSS when forking a galaxy cluster.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2021app/View/SharingGroups/view.ctp in MISP before 2.4.146 allows stored XSS in the sharing groups view.CVE-2021-36212 · Other software · Misp-project · reported by MITREMedium 6.1
app/View/SharingGroups/view.ctp in MISP before 2.4.146 allows stored XSS in the sharing groups view.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2021app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-template:index.CVE-2021-35502 · Other software · Misp-project · reported by MITRECritical 9.8
app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-template:index.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.