Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
385 results · page 5 of 8
Jul 18, 2023Vulnerability in the Oracle Hyperion Workspace product of Oracle Hyperion (component: UI and Visualization).CVE-2023-22060 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.6
Vulnerability in the Oracle Hyperion Workspace product of Oracle Hyperion (component: UI and Visualization). The supported version that is affected is 11.2.13.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Workspace. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Workspace accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Workspace accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Workspace. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L).
- Product
- Hyperion BI+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023A vulnerability has been identified in Citrix Workspace app for Linux that, if exploited, may result in a malicious local user being able to gain access to the CVE-2023-24486 · Network & remote access · Citrix · reported by secure@citrix.comMedium 5.5
A vulnerability has been identified in Citrix Workspace app for Linux that, if exploited, may result in a malicious local user being able to gain access to the Citrix Virtual Apps and Desktops session of another user who is using the same computer from which the ICA session is launched.
- Product
- Citrix Workspace app for Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.citrix.comsupport.citrix.com
Jun 29, 2023A security defect was identified in Foundry workspace-server that enabled a user to bypass an authorization check and view settings related to 'Developer Mode'.CVE-2023-30955 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 4.3
A security defect was identified in Foundry workspace-server that enabled a user to bypass an authorization check and view settings related to 'Developer Mode'. This enabled users with insufficient privilege the ability to view and interact with Developer Mode settings in a limited capacity. A fix was deployed with workspace-server 7.7.0.
- Product
- com.palantir.workspace:workspace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpalantir.safebase.uspalantir.safebase.us
Jun 22, 2023Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agentCVE-2023-3114 · Other software · HashiCorp · reported by security@hashicorp.comMedium 5
Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agents. This authorization flaw could potentially allow a workspace to access resources from a separate, higher-privileged workspace in the same organization that targeted an agent pool. This vulnerability, CVE-2023-3114, is fixed in Terraform Enterprise v202306-1.
- Product
- Terraform Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comdiscuss.hashicorp.com
May 30, 2023VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability.CVE-2023-20884 · Other software · VMware · reported by security@vmware.comMedium 6.1
VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. An unauthenticated malicious actor may be able to redirect a victim to an attacker controlled domain due to improper path handling leading to sensitive information disclosure.
- Product
- Identity Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2023In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running.CVE-2023-32784 · Other software · Keepass · reported by MITREHigh 7.5
In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system. The first character cannot be recovered. In 2.54, there is different API usage and/or random string insertion for mitigation.
- Product
- Keepass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attacker with access toCVE-2023-2257 · Other software · Devolutions · reported by security@devolutions.netHigh 7.8
Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attacker with access to the user interface to unlock a Hub Business space without being prompted to enter the password via an unimplemented "Force Login" security feature. This vulnerability occurs only if "Force Login" feature is enabled on the Hub Business instance and that an attacker has access to a locked Workspace desktop application configured with a Hub Business space.
- Product
- Workspace Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevolutions.netdevolutions.net
Mar 10, 2023Jenkins 2.393 and earlier, LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows attackers with Item/Workspace permission CVE-2023-27902 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows attackers with Item/Workspace permission to access their contents.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2023VMware Workspace ONE Content contains a passcode bypass vulnerability.CVE-2023-20857 · Other software · VMware · reported by security@vmware.comMedium 6.8
VMware Workspace ONE Content contains a passcode bypass vulnerability. A malicious actor, with access to a users rooted device, may be able to bypass the VMware Workspace ONE Content passcode.
- Product
- Workspace ONE Content
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvmware.com
Feb 16, 2023Vulnerabilities have been identified that, collectively, allow a standard Windows user to perform operations as SYSTEM on the computer running Citrix Workspace CVE-2023-24485 · Network & remote access · Citrix · reported by secure@citrix.comHigh 7.8
Vulnerabilities have been identified that, collectively, allow a standard Windows user to perform operations as SYSTEM on the computer running Citrix Workspace app.
- Product
- Citrix Workspace App for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.citrix.comsupport.citrix.com
Feb 16, 2023A malicious user can cause log files to be written to a directory that they do not have permission to write to.CVE-2023-24484 · Network & remote access · Citrix · reported by secure@citrix.comMedium 5.5
A malicious user can cause log files to be written to a directory that they do not have permission to write to.
- Product
- Citrix Workspace App for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.citrix.comsupport.citrix.com
Feb 7, 2023Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS)CVE-2022-47412 · Other software · ONLYOFFICE · reported by cve@rapid7.comMedium 5.4
Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition.
- Product
- Workspace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022VMware Workspace ONE Access and Identity Manager contain a broken authentication vulnerability.CVE-2022-31701 · Other software · VMware · reported by security@vmware.comMedium 5.3
VMware Workspace ONE Access and Identity Manager contain a broken authentication vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.3.
- Product
- Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022VMware Workspace ONE Access and Identity Manager contain an authenticated remote code execution vulnerability.CVE-2022-31700 · Other software · VMware · reported by security@vmware.comHigh 7.2
VMware Workspace ONE Access and Identity Manager contain an authenticated remote code execution vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.2.
- Product
- Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022VMware Workspace ONE Assist prior to 22.10 contains a Session fixation vulnerability.CVE-2022-31689 · Other software · VMware · reported by security@vmware.comCritical 9.8
VMware Workspace ONE Assist prior to 22.10 contains a Session fixation vulnerability. A malicious actor who obtains a valid session token may be able to authenticate to the application using that token.
- Product
- Workspace ONE Assist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022VMware Workspace ONE Assist prior to 22.10 contains a Reflected cross-site scripting (XSS) vulnerability.CVE-2022-31688 · Other software · VMware · reported by security@vmware.comMedium 6.1
VMware Workspace ONE Assist prior to 22.10 contains a Reflected cross-site scripting (XSS) vulnerability. Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user's window.
- Product
- Workspace ONE Assist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022VMware Workspace ONE Assist prior to 22.10 contains a Broken Access Control vulnerability.CVE-2022-31687 · Other software · VMware · reported by security@vmware.comCritical 9.8
VMware Workspace ONE Assist prior to 22.10 contains a Broken Access Control vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application.
- Product
- Workspace ONE Assist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022VMware Workspace ONE Assist prior to 22.10 contains a Broken Authentication Method vulnerability.CVE-2022-31686 · Other software · VMware · reported by security@vmware.comCritical 9.8
VMware Workspace ONE Assist prior to 22.10 contains a Broken Authentication Method vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application.
- Product
- Workspace ONE Assist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022VMware Workspace ONE Assist prior to 22.10 contains an Authentication Bypass vulnerability.CVE-2022-31685 · Other software · VMware · reported by security@vmware.comCritical 9.8
VMware Workspace ONE Assist prior to 22.10 contains an Authentication Bypass vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application.
- Product
- Workspace ONE Assist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access existing chats in the workspaces of any user of the application.CVE-2022-41708 · Other software · Relatedcode · reported by help@fluidattacks.comMedium 4.3
Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access existing chats in the workspaces of any user of the application. This is possible because the application does not validate permissions correctly.
- Product
- Messenger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Oct 19, 2022Jenkins 360 FireLine Plugin 1.7.2 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived arCVE-2022-43435 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.3
Jenkins 360 FireLine Plugin 1.7.2 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
- Product
- Jenkins 360 FireLine Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Oct 19, 2022Jenkins ScreenRecorder Plugin 0.7 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived arCVE-2022-43433 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins ScreenRecorder Plugin 0.7 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
- Product
- Jenkins ScreenRecorder Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Oct 19, 2022Jenkins XFramium Builder Plugin 1.0.22 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archivCVE-2022-43432 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins XFramium Builder Plugin 1.0.22 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
- Product
- Jenkins XFramium Builder Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Sep 8, 2022IBM Planning Analytics Local 2.0 allows web pages to be stored locally which can be read by another user on the system.CVE-2022-22314 · Other software · IBM · reported by psirt@us.ibm.comLow 3.3
IBM Planning Analytics Local 2.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 217371.
- Product
- Planning Analytics Workspace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Aug 5, 2022VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability.CVE-2022-31665 · Other software · VMware · reported by security@vmware.comHigh 7.2
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. A malicious actor with administrator and network access can trigger a remote code execution.
- Product
- Identity Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2022VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability.CVE-2022-31664 · Other software · VMware · reported by security@vmware.comHigh 7.8
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'.
- Product
- Identity Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2022VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a reflected cross-site scripting (XSS) vulnerability.CVE-2022-31663 · Other software · VMware · reported by security@vmware.comMedium 6.1
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a reflected cross-site scripting (XSS) vulnerability. Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user's window.
- Product
- Identity Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2022VMware Workspace ONE Access, Identity Manager, Connectors and vRealize Automation contain a path traversal vulnerability.CVE-2022-31662 · Other software · VMware · reported by security@vmware.comHigh 7.5
VMware Workspace ONE Access, Identity Manager, Connectors and vRealize Automation contain a path traversal vulnerability. A malicious actor with network access may be able to access arbitrary files.
- Product
- Identity Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2022VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two privilege escalation vulnerabilities.CVE-2022-31661 · Other software · VMware · reported by security@vmware.comHigh 7.8
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two privilege escalation vulnerabilities. A malicious actor with local access can escalate privileges to 'root'.
- Product
- Identity Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2022VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability.CVE-2022-31660 · Other software · VMware · reported by security@vmware.comHigh 7.8
VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'.
- Product
- Identity Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2022VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability.CVE-2022-31659 · Other software · VMware · reported by security@vmware.comHigh 7.2
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability. A malicious actor with administrator and network access can trigger a remote code execution.
- Product
- Identity Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2022VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability.CVE-2022-31658 · Other software · VMware · reported by security@vmware.comHigh 7.2
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. A malicious actor with administrator and network access can trigger a remote code execution.
- Product
- Identity Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2022VMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability.CVE-2022-31657 · Other software · VMware · reported by security@vmware.comCritical 9.8
VMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability. A malicious actor with network access may be able to redirect an authenticated user to an arbitrary domain.
- Product
- Identity Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2022VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users.CVE-2022-31656 · Other software · VMware · reported by security@vmware.comCritical 9.8
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.
- Product
- Identity Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2022When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero Clients.CVE-2022-1805 · Other software · Teradici · reported by hp-security-alert@hp.comHigh 8.1
When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero Clients. The issue could be exploited by an adversary that places a MITM (Man in the Middle) between a zero client and AWS session provisioner in the network. This issue is only applicable when connecting to an Amazon Workspace from a PCoIP Zero Client.
- Product
- Tera2 Pcoip Zero Client Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Jul 18, 2022A potential memory corruption issue was found in Capsule Workspace Android app (running on GrapheneOS).CVE-2022-23745 · Other software · Checkpoint · reported by cve@checkpoint.comHigh 7.5
A potential memory corruption issue was found in Capsule Workspace Android app (running on GrapheneOS). This could result in application crashing but could not be used to gather any sensitive information.
- Product
- Capsule Workspace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportcenter.us.checkpoint.comsupportcenter.us.checkpoint.com
Jun 14, 2022A vulnerability has been identified in Teamcenter Active Workspace V5.2 (All versions < V5.2.9), Teamcenter Active Workspace V6.0 (All versions < V6.0.3).CVE-2022-32145 · Other software · Siemens · reported by productcert@siemens.comMedium 6.1
A vulnerability has been identified in Teamcenter Active Workspace V5.2 (All versions < V5.2.9), Teamcenter Active Workspace V6.0 (All versions < V6.0.3). A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected application that could allow an attacker to execute malicious code by tricking users into accessing a malicious link.
- Product
- Teamcenter Active Workspace V5.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Jun 13, 2022npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie.CVE-2022-29244 · Other software · npm · reported by GitHubHigh 7.5
npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.
- Product
- npm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability.CVE-2022-22973 · Other software · VMware · reported by security@vmware.comHigh 7.8
VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'.
- Product
- Identity Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users.CVE-2022-22972 · Other software · VMware · reported by security@vmware.comCritical 9.8
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.
- Product
- Identity Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022The Workspace client component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains difficult toCVE-2022-22775 · Other software · TIBCO Software Inc. · reported by security@tibco.comHigh 8.1
The Workspace client component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains difficult to exploit Reflected Cross Site Scripting (XSS) vulnerabilities that allow low privileged attackers with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO BPM Enterprise: versions 4.3.1 and below and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric: versions 4.3.1 and below.
- Product
- TIBCO BPM Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022The package workspace-tools before 0.18.4 are vulnerable to Command Injection via git argument injection.CVE-2022-25865 · Computers, phones & browsers · Microsoft · reported by report@snyk.ioHigh 8.1
The package workspace-tools before 0.18.4 are vulnerable to Command Injection via git argument injection. When calling the fetchRemoteBranch(remote: string, remoteBranch: string, cwd: string) function, both the remote and remoteBranch parameters are passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
- Product
- Workspace-tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2022In JetBrains IntelliJ IDEA before 2022.1 local code execution via workspace settings was possibleCVE-2022-29815 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.9
In JetBrains IntelliJ IDEA before 2022.1 local code execution via workspace settings was possible
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Apr 25, 2022IBM Planning Analytics Local 2.0 could allow an attacker to upload arbitrary executable files which, when executed by an unsuspecting victim could result in codCVE-2022-22392 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.8
IBM Planning Analytics Local 2.0 could allow an attacker to upload arbitrary executable files which, when executed by an unsuspecting victim could result in code execution. IBM X-Force ID: 222066.
- Product
- Planning Analytics Workspace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Apr 25, 2022IBM Planning Analytics Workspace 2.0 could be vulnerable to malicious file upload by not validating the file types or sizes.CVE-2021-39040 · Other software · IBM · reported by psirt@us.ibm.comHigh 8
IBM Planning Analytics Workspace 2.0 could be vulnerable to malicious file upload by not validating the file types or sizes. Attackers can make use of this weakness and upload malicious executable files into the system and it can be sent to victim for performing further attacks. IBM X-Force ID: 214025.
- Product
- Planning Analytics Workspace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Apr 13, 2022VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning excess information.CVE-2022-22961 · Other software · VMware · reported by security@vmware.comMedium 5.3
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning excess information. A malicious actor with remote access may leak the hostname of the target system. Successful exploitation of this issue can lead to targeting victims.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability.CVE-2022-22959 · Other software · VMware · reported by security@vmware.comMedium 4.3
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability. A malicious actor can trick a user through a cross site request forgery to unintentionally validate a malicious JDBC URI.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958).CVE-2022-22958 · Other software · VMware · reported by security@vmware.comHigh 7.2
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote code execution.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958).CVE-2022-22957 · Other software · VMware · reported by security@vmware.comHigh 7.2
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote code execution.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Apr 13, 2022VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework.CVE-2022-22956 · Other software · VMware · reported by security@vmware.comCritical 9.8
VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and execute any operation due to exposed endpoints in the authentication framework.
- Product
- Identity Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.