Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
373 results · page 5 of 8
Oct 24, 2022Kirby is a flat-file CMS.CVE-2022-39314 · Other software · getkirby · reported by GitHubLow 3.7
Kirby is a flat-file CMS. In versions prior to 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, Kirby is subject to user enumeration due to Improper Restriction of Excessive Authentication Attempts. This vulnerability affects you only if you are using the `code` or `password-reset` auth method with the `auth.methods` option or if you have enabled the `debug` option in production. By using two or more IP addresses and multiple login attempts, valid user accounts will lock, but invalid accounts will not, leading to account enumeration. This issue has been patched in versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1. If you cannot update immediately, you can work around the issue by setting the `auth.methods` option to `password`, which disables the code-based login and password reset forms.
- Product
- kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php.CVE-2022-40047 · Other software · Flatpress · reported by MITREMedium 5.4
Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php.
- Product
- Flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022Flatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the Upload File function.CVE-2022-40048 · Other software · Flatpress · reported by MITREHigh 7.2
Flatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the Upload File function.
- Product
- Flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2022PNGDec commit 8abf6be was discovered to contain a global buffer overflow via inflate_fast at /src/inffast.c.CVE-2022-35011 · Other software · Pngdec Project · reported by MITREHigh 8.8
PNGDec commit 8abf6be was discovered to contain a global buffer overflow via inflate_fast at /src/inffast.c.
- Product
- Pngdec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2022zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field.CVE-2022-37434 · Other software · Siemens · reported by MITRECritical 9.8
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Jul 29, 2022An inflation issue was discovered in Chia Network CAT1 Standard 1.0.0.CVE-2022-36447 · Other software · Chia · reported by MITREHigh 7.5
An inflation issue was discovered in Chia Network CAT1 Standard 1.0.0. Previously minted tokens minted on the Chia blockchain using the CAT1 standard can be inflated to an arbitrary extent by any holder of any amount of the token. The total amount of the token can be increased as high as the malicious actor pleases. This is true for every CAT1 on the Chia blockchain regardless of issuance rules. This attack is auditable on chain, so maliciously altered coins can potentially be marked by off-chain observers as malicious.
- Product
- Network Cat1 Standard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022A stored cross-site scripting (XSS) vulnerability exists in FlatPress 1.2.1 that allows for arbitrary execution of JavaScript commands through blog content.CVE-2021-41432 · Other software · Flatpress · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability exists in FlatPress 1.2.1 that allows for arbitrary execution of JavaScript commands through blog content.
- Product
- Flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2022flatCore-CMS v2.0.8 has a code execution vulnerability, which could let a remote malicious user execute arbitrary PHP code.CVE-2021-41402 · Other software · Flatcore · reported by MITREHigh 8.8
flatCore-CMS v2.0.8 has a code execution vulnerability, which could let a remote malicious user execute arbitrary PHP code.
- Product
- Flatcore-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2022flatCore-CMS version 2.0.8 calls dangerous functions, causing server-side request forgery vulnerabilities.CVE-2021-41403 · Other software · Flatcore · reported by MITRECritical 9.8
flatCore-CMS version 2.0.8 calls dangerous functions, causing server-side request forgery vulnerabilities.
- Product
- Flatcore-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2022In unflatten of GraphicBuffer.cpp, there is a possible arbitrary code execution due to improper input validation.CVE-2022-20156 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In unflatten of GraphicBuffer.cpp, there is a possible arbitrary code execution due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-212803946References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 13, 2022flatCore-CMS version 2.0.8 is affected by Cross Site Scripting (XSS) in the "Create New Page" option through the index page.CVE-2021-40902 · Other software · Flatcore · reported by MITREMedium 5.4
flatCore-CMS version 2.0.8 is affected by Cross Site Scripting (XSS) in the "Create New Page" option through the index page.
- Product
- Flatcore-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2022FlatCore-CMS 2.0.9 has a cross-site scripting (XSS) vulnerability in pages.edit.php through meta tags and content sections.CVE-2021-42245 · Other software · Flatcore · reported by MITREMedium 6.1
FlatCore-CMS 2.0.9 has a cross-site scripting (XSS) vulnerability in pages.edit.php through meta tags and content sections.
- Product
- Flatcore-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2022zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.CVE-2018-25032 · Other software · Siemens · reported by MITREHigh 7.5
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Mar 1, 2022Insecure permissions in the file database.sdb of BatFlat CMS v1.3.6 allows attackers to dump the entire database.CVE-2021-41652 · Other software · Batflat · reported by MITREHigh 7.5
Insecure permissions in the file database.sdb of BatFlat CMS v1.3.6 allows attackers to dump the entire database.
- Product
- Batflat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeathflash1411.github.iogithub.com
Feb 15, 2022Flatpress v1.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability in the Upload SVG File function.CVE-2022-24588 · Other software · Flatpress · reported by MITREMedium 5.4
Flatpress v1.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability in the Upload SVG File function.
- Product
- Flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2022Flatpak is a Linux application sandboxing and distribution framework.CVE-2022-21682 · Other software · flatpak · reported by GitHubHigh 7.7
Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the build. At this point the build directory will have the full access that is specified in the manifest, so running `flatpak build` against it will gain those permissions. Normally this will not be done, so this is not problem. However, if `--mirror-screenshots-url` is specified, then flatpak-builder will launch `flatpak build --nofilesystem=host appstream-utils mirror-screenshots` after finalization, which can lead to issues even with the `--nofilesystem=host` protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the `appstream-util` binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of `--nofilesystem=home` and `--nofilesystem=host`.
- Product
- flatpak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2022Flatpak is a Linux application sandboxing and distribution framework.CVE-2021-43860 · Other software · flatpak · reported by GitHubHigh 8.2
Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, in the case that there's a null byte in the metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user. Flatpak shows permissions to the user during install by reading them from the "xa.metadata" key in the commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak compares these permissions to the *actual* metadata, from the "metadata" file to ensure it wasn't lied to. However, the actual metadata contents are loaded in several places where they are read as simple C-style strings. That means that, if the metadata file includes a null terminator, only the content of the file from *before* the terminator gets compared to xa.metadata. Thus, any permissions that appear in the metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously crafted apps can give themselves hidden permissions. Use
- Product
- flatpak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2021duoFAQ - Responsive, Flat, Simple FAQ WordPess: Reflected Cross-Site ScriptingCVE-2021-39319 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The duoFAQ - Responsive, Flat, Simple FAQ WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/duogeek/duogeek-panel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.8.
- Product
- duoFAQ - Responsive, Flat, Simple FAQ WordPess
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update duoFAQ - Responsive, Flat, Simple FAQ WordPess to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 1, 2021Flat Preloader: Does not escape some of its settingsCVE-2021-24789 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute in the frontend, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- Flat Preloader
- Fixed in
- 1.5.5
- What to do
- Update Flat Preloader to 1.5.5 or newer.
Nov 1, 2021Flat Preloader: Does not enforce nonce checksCVE-2021-24685 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and escape them, which could allow attackers to a make logged in admin change them with a Cross-Site Scripting payload (triggered either in the frontend or backend depending on the payload)
- Product
- Flat Preloader
- Fixed in
- 1.5.4
- What to do
- Update Flat Preloader to 1.5.4 or newer.
Oct 28, 2021flatcore-cms is vulnerable to Unrestricted Upload of File with Dangerous TypeCVE-2021-3745 · Other software · flatcore · reported by security@huntr.devMedium 6.6
flatcore-cms is vulnerable to Unrestricted Upload of File with Dangerous Type
- Product
- flatcore/flatcore-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2021Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.CVE-2021-41133 · Other software · flatpak · reported by GitHubHigh 8.8
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.
- Product
- flatpak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Aug 23, 2021Cross Site Scripting (XSS) vulnerability exiss in FlatCore-CMS 2.0.7 via the upload image function.CVE-2021-39609 · Other software · Flatcore · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability exiss in FlatCore-CMS 2.0.7 via the upload image function.
- Product
- Flatcore-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2021Remote Code Execution (RCE) vulnerabilty exists in FlatCore-CMS 2.0.7 via the upload addon plugin, which could let a remote malicious user exeuct arbitrary php CVE-2021-39608 · Other software · Flatcore · reported by MITREHigh 7.2
Remote Code Execution (RCE) vulnerabilty exists in FlatCore-CMS 2.0.7 via the upload addon plugin, which could let a remote malicious user exeuct arbitrary php code.
- Product
- Flatcore-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Aug 13, 2021The remove API in v1/controller/cloudStorage/alibabaCloud/remove/index.ts in netless Agora Flat Server before 2021-07-30 mishandles file ownership.CVE-2021-38621 · Other software · Netless · reported by MITRECritical 9.1
The remove API in v1/controller/cloudStorage/alibabaCloud/remove/index.ts in netless Agora Flat Server before 2021-07-30 mishandles file ownership.
- Product
- Flat Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2021An issue was discovered in the libp2p-deflate crate before 0.27.1 for Rust.CVE-2020-36443 · Other software · Libp2p · reported by MITRECritical 9.8
An issue was discovered in the libp2p-deflate crate before 0.27.1 for Rust. An uninitialized buffer is passed to AsyncRead::poll_read(), which is a user-provided trait function.
- Product
- Libp2p-deflate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Jul 30, 2021Cross Site Request Forgery (CSRF) vulnerability in FlatPress 1.1 via the DeleteFile function in flat/admin.php.CVE-2020-22761 · Other software · Flatpress · reported by MITREHigh 8.8
Cross Site Request Forgery (CSRF) vulnerability in FlatPress 1.1 via the DeleteFile function in flat/admin.php.
- Product
- Flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.combaomatcoban.info
May 27, 2021A heap-based Buffer Overflow vulnerability exits in FFmpeg 4.2 in deflate16 at libavfilter/vf_neighbor.c, which might lead to memory corruption and other potentCVE-2020-22027 · Other software · Ffmpeg · reported by MITREHigh 8.8
A heap-based Buffer Overflow vulnerability exits in FFmpeg 4.2 in deflate16 at libavfilter/vf_neighbor.c, which might lead to memory corruption and other potential consequences.
- Product
- Ffmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrac.ffmpeg.orgtrac.ffmpeg.org
Apr 26, 2021Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code executCVE-2021-25927 · Other software · Safe-flat Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
- Product
- Safe-flat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Mar 11, 2021Cross-site scripting (XSS) vulnerability in Navigation in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.CVE-2021-27679 · Other software · Batflat · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in Navigation in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.
- Product
- Batflat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2021Cross-site scripting (XSS) vulnerability in Snippets in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.CVE-2021-27678 · Other software · Batflat · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in Snippets in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.
- Product
- Batflat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2021Cross-site scripting (XSS) vulnerability in Galleries in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.CVE-2021-27677 · Other software · Batflat · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in Galleries in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.
- Product
- Batflat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2021Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.CVE-2021-21381 · Other software · flatpak · reported by GitHubHigh 7.1
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by the app's permissions. By putting the special tokens `@@` and/or `@@u` in the Exec field of a Flatpak app's .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had chosen to open a target file with their Flatpak app, which automatically makes that file available to the Flatpak app. This is fixed in version 1.10.2. A minimal solution is the first commit "`Disallow @@ and @@U usage in desktop files`". The follow-up commits "`dir: Reserve the whole @@ prefix`" and "`dir: Refuse to export .desktop files with suspicious uses of @@ tokens`" are recommended, but not strictly required. As a workaround, avoid installing Flatpak apps from untrusted sources, or check the contents of the exported `.desktop` files in `exports/share/applications/*.desktop` (typically `~/.local/share/flatpak/exports/share/applications/*.desktop` and `/var/lib/flatpak/exp
- Product
- flatpak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2021Sruu.pl in Batflat 1.3.6 allows an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the Users tab.CVE-2020-35734 · Other software · Batflat · reported by MITREHigh 7.2
Sruu.pl in Batflat 1.3.6 allows an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the Users tab. To exploit this, one must login to the administration panel and edit an arbitrary user's data (username, displayed name, etc.). NOTE: This vulnerability only affects products that are no longer supported by the maintainer
- Product
- Batflat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.combatflat.org
Jan 15, 2021An issue was discovered in flatCore before 2.0.0 build 139.CVE-2021-23838 · Other software · Flatcore · reported by MITREMedium 4.8
An issue was discovered in flatCore before 2.0.0 build 139. A reflected XSS vulnerability was identified in the media_filter HTTP request body parameter for the acp interface. The affected parameter accepts malicious client-side script without proper input sanitization. For example, a malicious user can leverage this vulnerability to steal cookies from a victim user and perform a session-hijacking attack, which may then lead to unauthorized access to the site.
- Product
- Flatcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 15, 2021An issue was discovered in flatCore before 2.0.0 build 139.CVE-2021-23837 · Other software · Flatcore · reported by MITREMedium 6.5
An issue was discovered in flatCore before 2.0.0 build 139. A time-based blind SQL injection was identified in the selected_folder HTTP request body parameter for the acp interface. The affected parameter (which retrieves the file contents of the specified folder) was found to be accepting malicious user input without proper sanitization, thus leading to SQL injection. Database related information can be successfully retrieved.
- Product
- Flatcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 15, 2021An issue was discovered in flatCore before 2.0.0 build 139.CVE-2021-23836 · Other software · Flatcore · reported by MITREMedium 4.8
An issue was discovered in flatCore before 2.0.0 build 139. A stored XSS vulnerability was identified in the prefs_smtp_psw HTTP request body parameter for the acp interface. An admin user can inject malicious client-side script into the affected parameter without any form of input sanitization. The injected payload will be executed in the browser of a user whenever one visits the affected module page.
- Product
- Flatcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 15, 2021An issue was discovered in flatCore before 2.0.0 build 139.CVE-2021-23835 · Other software · Flatcore · reported by MITREMedium 4.9
An issue was discovered in flatCore before 2.0.0 build 139. A local file disclosure vulnerability was identified in the docs_file HTTP request body parameter for the acp interface. This can be exploited with admin access rights. The affected parameter (which retrieves the contents of the specified file) was found to be accepting malicious user input without proper sanitization, thus leading to retrieval of backend server sensitive files, e.g., /etc/passwd, SQLite database files, PHP source code, etc.
- Product
- Flatcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 14, 2021Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.CVE-2021-21261 · Other software · flatpak · reported by GitHubHigh 7.3
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and before fixed versions 1.8.5 and 1.10.0. The Flatpak portal D-Bus service (`flatpak-portal`, also known by its D-Bus service name `org.freedesktop.portal.Flatpak`) allows apps in a Flatpak sandbox to launch their own subprocesses in a new sandbox instance, either with the same security settings as the caller or with more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service passes caller-specified environment variables to non-sandboxed processes on the host system, and in particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or compromised Flatpak app could set environment variab
- Product
- flatpak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2020An issue was discovered in the flatbuffers crate through 2020-04-11 for Rust.CVE-2020-35864 · Computers, phones & browsers · Google · reported by MITREHigh 7.5
An issue was discovered in the flatbuffers crate through 2020-04-11 for Rust. read_scalar (and read_scalar_at) can transmute values without unsafe blocks.
- Product
- Flatbuffers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 31, 2020An issue was discovered in the flatbuffers crate before 0.6.1 for Rust.CVE-2019-25004 · Computers, phones & browsers · Google · reported by MITRECritical 9.8
An issue was discovered in the flatbuffers crate before 0.6.1 for Rust. Arbitrary bytes can be reinterpreted as a bool, defeating soundness.
- Product
- Flatbuffers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 30, 2020FlatPress 1.0.3 is affected by cross-site scripting (XSS) in the Blog Content component.CVE-2020-35241 · Other software · Flatpress · reported by MITREMedium 4.8
FlatPress 1.0.3 is affected by cross-site scripting (XSS) in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in Blog content via the admin panel. Each time any user will go to that blog page, the XSS triggers and the attacker can steal the cookie according to the crafted payload.
- Product
- Flatpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2020Prototype pollution vulnerability in 'flattenizer' versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of service and may lead to remote code execCVE-2020-28279 · Other software · Flattenizer Project · reported by vulnerabilitylab@mend.ioCritical 9.8
Prototype pollution vulnerability in 'flattenizer' versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.
- Product
- Flattenizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Nov 27, 2020In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabCVE-2020-27218 · Other software · The Eclipse Foundation · reported by emo@eclipse.orgMedium 4.8
In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.
- Product
- Eclipse Jetty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.eclipse.orggithub.com
Sep 25, 2020In TensorFlow Lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, saved models in the flatbuffer format use a double indexing scheme: a model has a set CVE-2020-15211 · Other software · tensorflow · reported by GitHubMedium 4.8
In TensorFlow Lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, saved models in the flatbuffer format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators and each operator has a set of input/output tensors. The flatbuffer format uses indices for the tensors, indexing into an array of tensors that is owned by the subgraph. This results in a pattern of double array indexing when trying to get the data of each tensor. However, some operators can have some tensors be optional. To handle this scenario, the flatbuffer model uses a negative `-1` value as index for these tensors. This results in special casing during validation at model loading time. Unfortunately, this means that the `-1` index is a valid tensor index for any operator, including those that don't expect optional inputs and including for output tensors. Thus, this allows writing and reading from outside the bounds of heap allocated arrays, although only at a specific offset from the start of these arrays. This results in both read and write gadgets, albeit very limited in scope. The issue is patched in several commits (46d5b0852, 00302787b7, e11f5558, cd31fd0ce, 1970c
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orggithub.com
Sep 25, 2020QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case.CVE-2020-25085 · Other software · Qemu · reported by MITREMedium 5
QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case.
- Product
- Qemu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Sep 1, 2020All versions of package arr-flatten-unflatten are vulnerable to Prototype Pollution via the constructor.CVE-2020-7713 · Other software · Arr-flatten-unflatten Project · reported by report@snyk.ioCritical 9.8
All versions of package arr-flatten-unflatten are vulnerable to Prototype Pollution via the constructor.
- Product
- Arr-flatten-unflatten
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2020flatCore before 1.5.7 allows upload and execution of a .php file by an admin.CVE-2020-17452 · Other software · Flatcore · reported by MITREHigh 7.2
flatCore before 1.5.7 allows upload and execution of a .php file by an admin.
- Product
- Flatcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.openwall.netsec-consult.com
Aug 9, 2020flatCore before 1.5.7 allows XSS by an admin via the acp/acp.php?tn=pages&sub=edit&editpage=1 page_linkname, page_title, page_content, or page_extracontent paraCVE-2020-17451 · Other software · Flatcore · reported by MITREMedium 4.8
flatCore before 1.5.7 allows XSS by an admin via the acp/acp.php?tn=pages&sub=edit&editpage=1 page_linkname, page_title, page_content, or page_extracontent parameter, or the acp/acp.php?tn=system&sub=sys_pref prefs_pagename, prefs_pagetitle, or prefs_pagesubtitle parameter.
- Product
- Flatcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.openwall.netsec-consult.com
Jun 27, 2020In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive propertCVE-2020-15358 · Other software · Siemens · reported by MITREMedium 5.5
In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.