Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
484 results · page 5 of 10
Jan 4, 2024httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability.CVE-2024-22049 · Other software · Debian · reported by VulnCheckMedium 5.3
httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2023Pre* Party Resource Hints: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50855 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sam Perrow Pre* Party Resource Hints.This issue affects Pre* Party Resource Hints: from n/a through 1.8.18.
- Product
- Pre* Party Resource Hints
- Affected
- up to 1.8.18
- What to do
- Affects up to 1.8.18. Update Pre* Party Resource Hints to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 24, 2023Use of a Third Party library produced a vulnerability in Barracuda Networks Inc.CVE-2023-7102 · Network & remote access · Barracuda Networks Inc. · reported by mandiant-cve@google.comCritical 9.8
Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.
- Product
- Barracuda ESG Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2023`nuxt-api-party` is an open source module to proxy API requests.CVE-2023-49800 · Other software · johannschopplich · reported by GitHubHigh 7.5
`nuxt-api-party` is an open source module to proxy API requests. The library allows the user to send many options directly to `ofetch`. There is no filter on which options are available. We can abuse the retry logic to cause the server to crash from a stack overflow. fetchOptions are obtained directly from the request body. A malicious user can construct a URL known to not fetch successfully, then set the retry attempts to a high value, this will cause a stack overflow as ofetch error handling works recursively resulting in a denial of service. This issue has been addressed in version 0.22.1. Users are advised to upgrade. Users unable to upgrade should limit ofetch options.
- Product
- nuxt-api-party
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2023`nuxt-api-party` is an open source module to proxy API requests.CVE-2023-49799 · Other software · johannschopplich · reported by GitHubHigh 7.5
`nuxt-api-party` is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforementioned attack. This has been recently changed to use the regular expression `^https?://`, however this regular expression can be bypassed by an absolute URL with leading whitespace. For example `\nhttps://whatever.com` which has a leading newline. According to the fetch specification, before a fetch is made the URL is normalized. "To normalize a byte sequence potentialValue, remove any leading and trailing HTTP whitespace bytes from potentialValue.". This means the final request will be normalized to `https://whatever.com` bypassing the check and nuxt-api-party will send a request outside of the whitelist. This could allow us to leak credentials or perform Server-Side Request Forgery (SSRF). This vulnerability has been addressed in version 0.22.1. Users are advised to upgrade. Users unable to upgrade should revert to the previous method of detecting absolute URLs.
- Product
- nuxt-api-party
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfetch.spec.whatwg.orgfetch.spec.whatwg.org
Dec 4, 2023 Several versions of ALEOS, including ALEOS 4.16.0, include an opensource third-party component which can be exploited from the local area networCVE-2023-40465 · Other software · SierraWireless · reported by security@sierrawireless.comHigh 8.3
Several versions of ALEOS, including ALEOS 4.16.0, include an opensource third-party component which can be exploited from the local area network, resulting in a Denial of Service condition for the captive portal.
- Product
- ALEOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.sierrawireless.comsource.sierrawireless.com
Dec 4, 2023Patch in third party library Consul requires 'enable-script-checks' to be set to False.CVE-2023-5332 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.9
Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comhashicorp.com
Nov 14, 2023vantage6 is a framework to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC).CVE-2023-47631 · Other software · vantage6 · reported by GitHubHigh 7.2
vantage6 is a framework to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). In affected versions a node does not check if an image is allowed to run if a `parent_id` is set. A malicious party that breaches the server may modify it to set a fake `parent_id` and send a task of a non-whitelisted algorithm. The node will then execute it because the `parent_id` that is set prevents checks from being run. This impacts all servers that are breached by an expert user. This vulnerability has been patched in version 4.1.2. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- vantage6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2023OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go.CVE-2023-47108 · Other software · open-telemetry · reported by GitHubHigh 7.5
OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels `net.peer.sock.addr` and `net.peer.sock.port` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests. Version 0.46.0 contains a fix for this issue. As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing `otelgrpc.WithMeterProvider` option with `noop.NewMeterProvider`.
- Product
- opentelemetry-go-contrib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023In UsageStatsService, there is a possible way to read installed 3rd party apps due to side channel information disclosure.CVE-2023-21319 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In UsageStatsService, there is a possible way to read installed 3rd party apps due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In verifyDefaults of CardEmulationManager.java, there is a possible way to set a third party app as the default contactless payment app without user consent dueCVE-2021-39810 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In verifyDefaults of CardEmulationManager.java, there is a possible way to set a third party app as the default contactless payment app without user consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Yettiesoft VestCert versions 2.36 to 2.5.29, a vulnerability exists due to improper validation of third-party modules.CVE-2023-45798 · Other software · Yettiesoft · reported by vuln@krcert.or.krHigh 8.4
In Yettiesoft VestCert versions 2.36 to 2.5.29, a vulnerability exists due to improper validation of third-party modules. This allows malicious actors to load arbitrary third-party modules, leading to remote code execution.
- Product
- VestCert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023The vulnerability allows an unprivileged(untrusted) third-party application to interact with a content-provider unsafely exposed by the Android Agent applicatioCVE-2023-41960 · Other software · Rexroth · reported by psirt@bosch.comHigh 7.1
The vulnerability allows an unprivileged(untrusted) third-party application to interact with a content-provider unsafely exposed by the Android Agent application, potentially modifying sensitive settings of the Android Client application itself.
- Product
- ctrlX HMI Web Panel - WR21 (WR2107)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Oct 25, 2023The vulnerability allows an unprivileged (untrusted) third- party application to arbitrary modify the server settings of the Android Client application, inducinCVE-2023-41372 · Other software · Rexroth · reported by psirt@bosch.comHigh 7.8
The vulnerability allows an unprivileged (untrusted) third- party application to arbitrary modify the server settings of the Android Client application, inducing it to connect to an attacker - controlled malicious server.This is possible by forging a valid broadcast intent encrypted with a hardcoded RSA key pair
- Product
- ctrlX HMI Web Panel - WR21 (WR2107)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Oct 12, 2023OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go.CVE-2023-45142 · Other software · open-telemetry · reported by GitHubHigh 7.5
OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and U
- Product
- opentelemetry-go-contrib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2023The RDPWin.dll component as used in the IRM Next Generation booking engine includes a set of hardcoded API keys for third-party services such as Twilio and VonaCVE-2023-39421 · Other software · Resort Data Processing, Inc. · reported by cve-requests@bitdefender.comHigh 7.7
The RDPWin.dll component as used in the IRM Next Generation booking engine includes a set of hardcoded API keys for third-party services such as Twilio and Vonage. These keys allow unrestricted interaction with these services.
- Product
- IRM Next Generation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitdefender.combitdefender.com
Aug 14, 2023In openContentUri of ActivityManagerService.java, there is a possible way for a third party app to obtain restricted files due to a confused deputy.CVE-2023-21292 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In openContentUri of ActivityManagerService.java, there is a possible way for a third party app to obtain restricted files due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Jul 25, 2023copyparty is file server software.CVE-2023-38501 · Other software · 9001 · reported by GitHubMedium 6.3
copyparty is file server software. Prior to version 1.8.7, the application contains a reflected cross-site scripting via URL-parameter `?k304=...` and `?setck=...`. The worst-case outcome of this is being able to move or delete existing files on the server, or upload new files, using the account of the person who clicks the malicious link. It is recommended to change the passwords of one's copyparty accounts, unless one have inspected one's logs and found no trace of attacks. Version 1.8.7 contains a patch for the issue.
- Product
- copyparty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jul 14, 2023Copyparty is a portable file server.CVE-2023-37474 · Other software · 9001 · reported by GitHubHigh 7.5
Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside the web document root directory. This issue has been addressed in commit `043e3c7d` which has been included in release 1.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- copyparty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jul 13, 2023Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint.CVE-2023-29458 · Other software · Zabbix · reported by security@zabbix.comMedium 5.9
Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solution that we use.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.zabbix.comlists.debian.org
Jul 10, 2023WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin: Use a third-party library that removes the escaping on some HTML charactersCVE-2023-1119 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin WordPress plugin before 2.4.1 use a third-party library that removes the escaping on some HTML characters, leading to a cross-site scripting vulnerability.
- Product
- WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin
- Fixed in
- 3.2.13
- What to do
- Update WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin to 3.2.13 or newer.
Jul 6, 2023An OS command injection vulnerability exists in the ys_thirdparty system_user_script functionality of Milesight UR32L v32.3.0.5.CVE-2023-24595 · Other software · Milesight · reported by talos-cna@cisco.comHigh 7.2
An OS command injection vulnerability exists in the ys_thirdparty system_user_script functionality of Milesight UR32L v32.3.0.5. A specially crafted series of network requests can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability.
- Product
- UR32L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jul 6, 2023An OS command injection vulnerability exists in the ys_thirdparty user_delete functionality of Milesight UR32L v32.3.0.5.CVE-2023-23550 · Other software · Milesight · reported by talos-cna@cisco.comHigh 7.2
An OS command injection vulnerability exists in the ys_thirdparty user_delete functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability.
- Product
- UR32L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jul 6, 2023An OS command injection vulnerability exists in the ys_thirdparty check_system_user functionality of Milesight UR32L v32.3.0.5.CVE-2023-22365 · Other software · Milesight · reported by talos-cna@cisco.comHigh 7.2
An OS command injection vulnerability exists in the ys_thirdparty check_system_user functionality of Milesight UR32L v32.3.0.5. A specially crafted set of network packets can lead to command execution. An attacker can send a network request to trigger this vulnerability.
- Product
- UR32L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jul 6, 2023Vulnerability that a unique value can be obtained by a third-party app in the DSoftBus module.CVE-2022-48516 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Vulnerability that a unique value can be obtained by a third-party app in the DSoftBus module. Successful exploitation of this vulnerability will affect confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Jun 19, 2023Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the desktopCVE-2023-34167 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the desktop to prevent them from being uninstalled.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jun 19, 2023Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the desktopCVE-2023-34160 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the desktop to prevent them from being uninstalled.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jun 19, 2023Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the desktopCVE-2023-34158 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the desktop to prevent them from being uninstalled.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jun 16, 2023Unauthorized access vulnerability in the Save for later feature provided by AI Touch.Successful exploitation of this vulnerability may cause third-party apps toCVE-2023-34165 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
Unauthorized access vulnerability in the Save for later feature provided by AI Touch.Successful exploitation of this vulnerability may cause third-party apps to forge a URI for unauthorized access with zero permissions.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Jun 16, 2023Vulnerability of undefined permissions in HUAWEI VR screen projection.Successful exploitation of this vulnerability will cause third-party apps to create windowCVE-2023-34154 · Other software · Huawei · reported by psirt@huawei.comHigh 8.2
Vulnerability of undefined permissions in HUAWEI VR screen projection.Successful exploitation of this vulnerability will cause third-party apps to create windows in an arbitrary way, consuming system resources.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
May 20, 2023Authorization Bypass Through User-Controlled Key vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform allows AuthenticaCVE-2023-2713 · Other software · Unknown · reported by iletisim@usom.gov.trCritical 9.8
Authorization Bypass Through User-Controlled Key vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform allows Authentication Abuse, Authentication Bypass. This issue affects Rental Module: before 23.05.15.
- Product
- Rental Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
May 20, 2023Unrestricted Upload of File with Dangerous Type vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform allows Command InjCVE-2023-2712 · Other software · Unknown · reported by iletisim@usom.gov.trCritical 9.8
Unrestricted Upload of File with Dangerous Type vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform allows Command Injection, Using Malicious Files, Upload a Web Shell to a Web Server. This issue affects Rental Module: before 23.05.15.
- Product
- Rental Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Apr 3, 2023mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality.CVE-2023-28625 · Other software · OpenIDC · reported by GitHubHigh 7.5
mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using `OIDCStripCookies`.
- Product
- mod_auth_openidc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser.CVE-2023-0093 · Other software · Okta · reported by psirt@okta.comHigh 8.8
Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit this issue, an attacker would need to phish the user to enter an attacker controlled server URL during enrollment.
- Product
- Advanced Server Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.okta.comtrust.okta.com
Mar 2, 2023Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0.CVE-2023-1160 · Other software · cockpit-hq · reported by security@huntr.devMedium 5.5
Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0.
- Product
- cockpit-hq/cockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2023A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver.CVE-2022-45139 · Other software · WAGO · reported by info@cert.vde.comMedium 5.3
A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality.
- Product
- Compact Controller CC100 (751-9301)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Feb 21, 2023Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform CVE-2022-31394 · Other software · Hyper · reported by MITREHigh 7.5
Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks.
- Product
- Hyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2023In Splunk Add-on Builder (AoB) versions below 4.1.2 and the Splunk CloudConnect SDK versions below 3.1.3, requests to third-party APIs through the REST API ModuCVE-2023-22943 · Other software · Splunk · reported by prodsec@splunk.comMedium 4.8
In Splunk Add-on Builder (AoB) versions below 4.1.2 and the Splunk CloudConnect SDK versions below 3.1.3, requests to third-party APIs through the REST API Modular Input incorrectly revert to using HTTP to connect after a failure to connect over HTTPS occurs.
- Product
- Splunk Add-on Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisory.splunk.comadvisory.splunk.com
Feb 10, 2023 Dell SupportAssist contains a rate limit bypass issues in screenmeet API third party component.CVE-2022-34389 · Other software · Dell · reported by security_alert@emc.comLow 3.7
Dell SupportAssist contains a rate limit bypass issues in screenmeet API third party component. An unauthenticated attacker could potentially exploit this vulnerability and impersonate a legitimate dell customer to a dell support technician.
- Product
- SupportAssist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2023A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes theCVE-2022-38778 · Other software · Elastic · reported by security@elastic.coMedium 6.5
A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes the Kibana server process.
- Product
- kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.coelastic.co
Jan 26, 2023LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools.CVE-2023-23611 · Other software · openedx · reported by GitHubMedium 5.4
LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, prior to 7.2.2, are vulnerable to Missing Authorization. Any LTI tool that is integrated with on the Open edX platform can post a grade back for any LTI XBlock so long as it knows or can guess the block location for that XBlock. An LTI tool submits scores to the edX platform for line items. The code that uploads that score to the LMS grade tables determines which XBlock to upload the grades for by reading the resource_link_id field of the associated line item. The LTI tool may submit any value for the resource_link_id field, allowing a malicious LTI tool to submit scores for any LTI XBlock on the platform. The impact is a loss of integrity for LTI XBlock grades. This issue is patched in 7.2.2. No workarounds exist.
- Product
- xblock-lti-consumer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022If two Workers were simultaneously initializing their CacheStorage, a data race could have occurred in the `ThirdPartyUtil` component.CVE-2022-42930 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.1
If two Workers were simultaneously initializing their CacheStorage, a data race could have occurred in the `ThirdPartyUtil` component. This vulnerability affects Firefox < 106.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 15, 2022An access issue was addressed with additional sandbox restrictions on third-party apps.CVE-2022-32945 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
An access issue was addressed with additional sandbox restrictions on third-party apps. This issue is fixed in macOS Ventura 13. An app may be able to record audio with paired AirPods.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Nov 9, 2022The HiView module has a vulnerability of not filtering third-party apps out when the HiView module traverses to invoke the system provider.CVE-2022-44553 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
The HiView module has a vulnerability of not filtering third-party apps out when the HiView module traverses to invoke the system provider. Successful exploitation of this vulnerability may cause third-party apps to start periodically.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Nov 7, 2022The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-44054 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-utility package. The affected version of d8s-htm is 0.1.0.
- Product
- D8s-xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2022The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-44053 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-user-agents package. The affected version of d8s-htm is 0.1.0.
- Product
- D8s-networking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2022The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-44052 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-timezones package. The affected version of d8s-htm is 0.1.0.
- Product
- D8s-dates
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2022The d8s-stats for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-44051 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-stats for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-math package. The affected version of d8s-htm is 0.1.0.
- Product
- D8s-stats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2022The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-44050 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-json package. The affected version of d8s-htm is 0.1.0.
- Product
- D8s-networking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2022The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-44049 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-grammars package. The affected version of d8s-htm is 0.1.0.
- Product
- D8s-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.