Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,938 results · page 54 of 99
Jan 3, 2024An issue in Tamaki_hamanoki Line v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.CVE-2023-45559 · Other software · Linecorp · reported by MITREHigh 8.2
An issue in Tamaki_hamanoki Line v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2024HCL DRYiCE MyXalytics is impacted by the use of a broken cryptographic algorithm for encryption, potentially giving an attacker ability to decrypt sensitive infCVE-2023-50350 · Other software · HCL Software · reported by psirt@hcl.comHigh 8.2
HCL DRYiCE MyXalytics is impacted by the use of a broken cryptographic algorithm for encryption, potentially giving an attacker ability to decrypt sensitive information.
- Product
- DRYiCE MyXalytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Jan 2, 2024An issue in A-WORLD OIRASE BEER_waiting Line v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.CVE-2023-45561 · Other software · Linecorp · reported by MITREMedium 5.3
An issue in A-WORLD OIRASE BEER_waiting Line v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2023resumable.php (aka PHP backend for resumable.js) 0.1.4 before 3c6dbf5 allows arbitrary file upload anywhere in the filesystem via ../ in multipart/form-data conCVE-2023-52086 · Other software · Startutorial · reported by MITREHigh 8.1
resumable.php (aka PHP backend for resumable.js) 0.1.4 before 3c6dbf5 allows arbitrary file upload anywhere in the filesystem via ../ in multipart/form-data content to upload.php. (File overwrite hasn't been possible with the code available in GitHub in recent years, however.)
- Product
- PHP Backend For Resumable.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2023There is broken access control during authentication in Jamf Pro Server before 10.46.1.CVE-2023-31224 · Other software · Jamf · reported by MITRECritical 9.8
There is broken access control during authentication in Jamf Pro Server before 10.46.1.
- Product
- Jamf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlearn.jamf.comlearn.jamf.com
Dec 22, 2023A vulnerability was found in slawkens MyAAC up to 0.8.13.CVE-2023-7076 · Other software · slawkens · reported by VulDBLow 3.5
A vulnerability was found in slawkens MyAAC up to 0.8.13. It has been declared as problematic. This vulnerability affects unknown code of the file system/pages/bugtracker.php. The manipulation of the argument bug[2]['subject']/bug[2]['text']/report['subject'] leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.8.14 is able to address this issue. The name of the patch is 83a91ec540072d319dd338abff45f8d5ebf48190. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248848.
- Product
- MyAAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2023An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be read with an improperly scoped token.CVE-2023-51380 · Other software · GitHub · reported by product-cna@github.comLow 2.7
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be read with an improperly scoped token. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1.
- Product
- Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Dec 21, 2023An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be updated with an improperly scoped token.CVE-2023-51379 · Other software · GitHub · reported by product-cna@github.comMedium 4.9
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be updated with an improperly scoped token. This vulnerability did not allow unauthorized access to any repository content as it also required contents:write and issues:read permissions. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.17.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1.
- Product
- Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Dec 19, 2023Xpand IT Write-back Manager v2.3.1 uses weak secret keys to sign JWT tokens.CVE-2023-27172 · Other software · Xpand-it · reported by MITRECritical 9.1
Xpand IT Write-back Manager v2.3.1 uses weak secret keys to sign JWT tokens. This allows attackers to easily obtain the secret key used to sign JWT tokens via a bruteforce attack.
- Product
- Write-back Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbalwurk.github.ioghostline.neocities.org
Dec 18, 2023A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends.CVE-2023-6918 · Other software · Red Hat · reported by Red HatLow 3.7
A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.
- Product
- Red Hat Enterprise Linux 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Dec 18, 2023Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro: Does not check nonce tokens early enough in the request lifecycleCVE-2023-5886 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers with the ability to upload files to make logged in users perform unwanted actions leading to PHAR deserialization, which may lead to remote code execution.
- Product
- Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro
- Fixed in
- 1.4.0
- What to do
- Update Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro to 1.4.0 or newer.
Dec 18, 2023Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro: Does not check nonce tokens early enough in the request lifecycleCVE-2023-5882 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution.
- Product
- Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro
- Fixed in
- 1.4.0
- What to do
- Update Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro to 1.4.0 or newer.
Dec 18, 2023An arithmetic overflow flaw was found in Satellite when creating a new personal access token.CVE-2023-4320 · Other software · Red Hat · reported by Red HatHigh 7.6
An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to create personal access tokens that are valid indefinitely, resulting in damage to the system's integrity.
- Product
- Red Hat Satellite 6.15 for RHEL 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Dec 14, 2023A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token.CVE-2023-6134 · Other software · Red Hat · reported by Red HatMedium 4.6
A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.
- Product
- Red Hat build of Keycloak 22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Dec 13, 2023Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier does not mask PaaSLane authentication tokens displayed on the job configuration form, increasing the potentiaCVE-2023-50777 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier does not mask PaaSLane authentication tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
- Product
- Jenkins PaaSLane Estimate Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Dec 13, 2023Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier stores PaaSLane authentication tokens unencrypted in job config.xml files on the Jenkins controller where theCVE-2023-50776 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier stores PaaSLane authentication tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
- Product
- Jenkins PaaSLane Estimate Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Dec 13, 2023Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers CVE-2023-50773 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
- Product
- Jenkins Dingding JSON Pusher Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Dec 13, 2023Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed CVE-2023-50772 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
- Product
- Jenkins Dingding JSON Pusher Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Dec 13, 2023Silverpeas Core 6.3.1 administrative "Bin" feature is affected by broken access control.CVE-2023-47325 · Other software · Silverpeas · reported by MITREMedium 5.4
Silverpeas Core 6.3.1 administrative "Bin" feature is affected by broken access control. A user with low privileges is able to navigate directly to the bin, revealing all deleted spaces. The user can then restore or permanently delete the spaces.
- Product
- Silverpeas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2023A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate arbitrary uCVE-2023-36647 · Other software · Prolion · reported by MITREHigh 7.5
A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate arbitrary users and roles in web management and REST API endpoints via crafted JWT tokens.
- Product
- Cryptospike
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcvcn.gov.itcvcn.gov.it
Dec 10, 2023A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workCVE-2023-5870 · Other software · Red Hat · reported by Red HatLow 2.2
A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack.
- Product
- Red Hat Advanced Cluster Security 4.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Dec 7, 2023An issue in studio kent mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.CVE-2023-43305 · Other software · Linecorp · reported by MITREHigh 8.2
An issue in studio kent mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023An issue in PARK DANDAN mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.CVE-2023-43304 · Other software · Linecorp · reported by MITREHigh 8.2
An issue in PARK DANDAN mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023An issue in craftbeer bar canvas mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token (via CVE-2023-43303 · Other software · Linecorp · reported by MITREHigh 8.2
An issue in craftbeer bar canvas mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token (via captured network traffic).
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023An issue in sanTas mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.CVE-2023-43302 · Other software · Linecorp · reported by MITREHigh 8.2
An issue in sanTas mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023An issue in DARTS SHOP MAXIM mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.CVE-2023-43301 · Other software · Linecorp · reported by MITREHigh 8.2
An issue in DARTS SHOP MAXIM mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023An issue in urban_project mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.CVE-2023-43300 · Other software · Linecorp · reported by MITREHigh 8.2
An issue in urban_project mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023An issue in DA BUTCHERS mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.CVE-2023-43299 · Other software · Linecorp · reported by MITREMedium 5.3
An issue in DA BUTCHERS mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023An issue in SCOL Members Card mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.CVE-2023-43298 · Other software · Linecorp · reported by MITREMedium 5.3
An issue in SCOL Members Card mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2023A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files uploaded by other usCVE-2023-28876 · Other software · Afian · reported by MITREMedium 4.3
A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files uploaded by other users.
- Product
- Filerun
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfilerun.comherolab.usd.de
Dec 4, 2023The Jupyter Server provides the backend (i.e.CVE-2023-49080 · Other software · jupyter-server · reported by GitHubLow 3.5
The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an authenticated user include traceback information, which can include path information. There is no known mechanism by which to trigger these errors without authentication, so the paths revealed are not considered particularly sensitive, given that the requesting user has arbitrary execution permissions already in the same environment. A fix has been introduced in commit `0056c3aa52` which no longer includes traceback information in JSON error responses. For compatibility, the traceback field is present, but always empty. This commit has been included in version 2.11.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- jupyter_server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023Broken Link Checker for YouTube: Cross-Site Request Forgery (CSRF)CVE-2023-48281 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Super Blog Me Broken Link Checker for YouTube allows Cross Site Request Forgery.This issue affects Broken Link Checker for YouTube: from n/a through 1.3.
- Product
- Broken Link Checker for YouTube
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Broken Link Checker for YouTube to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 29, 2023In Dreamer CMS before 4.0.1, the backend attachment management office has an Arbitrary File Download vulnerability.CVE-2023-46887 · Other software · Iteachyou · reported by MITREHigh 7.5
In Dreamer CMS before 4.0.1, the backend attachment management office has an Arbitrary File Download vulnerability.
- Product
- Dreamer CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2023An issue in GitKraken GitLens before v.14.0.0 allows an attacker to execute arbitrary code via a crafted file to the Visual Studio Codes workspace trust componeCVE-2023-46944 · Other software · Gitkraken · reported by MITREHigh 7.8
An issue in GitKraken GitLens before v.14.0.0 allows an attacker to execute arbitrary code via a crafted file to the Visual Studio Codes workspace trust component.
- Product
- Gitlens
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsonarsource.com
Nov 28, 2023The Admin Classic Bundle provides a Backend UI for Pimcore.CVE-2023-49075 · Other software · pimcore · reported by GitHubHigh 8.4
The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundle\Security\PimcoreUserTwoFactorCondition` introduced in v11 disable the two factor authentication for all non-admin security firewalls. An authenticated user can access the system without having to provide the two factor credentials. This issue has been patched in version 1.2.2.
- Product
- admin-ui-classic-bundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2023A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.CVE-2023-42366 · Other software · Busybox · reported by MITREMedium 5.5
A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.
- Product
- Busybox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.busybox.netbugs.busybox.net
Nov 27, 2023POST SMTP Mailer: Does not escape email message content before displaying it in the backendCVE-2023-5958 · WordPress plugins & themes · reported by WPScanMedium 6.1
The POST SMTP Mailer WordPress plugin before 2.7.1 does not escape email message content before displaying it in the backend, allowing an unauthenticated attacker to perform XSS attacks against highly privileged users.
- Product
- POST SMTP Mailer
- Fixed in
- 2.7.1
- What to do
- Update POST SMTP Mailer to 2.7.1 or newer.
Nov 22, 2023In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, broken Access Control on X11 server sockets allows authenticated attackers (with access to CVE-2023-47250 · Other software · M-privacy · reported by MITREHigh 8.8
In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, broken Access Control on X11 server sockets allows authenticated attackers (with access to a VNC session) to access the X11 desktops of other users by specifying their DISPLAY ID. This allows complete control of their desktop, including the ability to inject keystrokes and perform a keylogging attack.
- Product
- Mprivacy-tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Nov 20, 2023An Insecure Permissions issue in WebsiteGuide v.0.2 allows a remote attacker to gain escalated privileges via crafted jwt (JSON web token).CVE-2023-48176 · Other software · Mizhexiaoxiao · reported by MITRECritical 9.8
An Insecure Permissions issue in WebsiteGuide v.0.2 allows a remote attacker to gain escalated privileges via crafted jwt (JSON web token).
- Product
- Websiteguide
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprairie-steed-4d7.notion.siteprairie-steed-4d7.notion.site
Nov 20, 2023The Community Edition version 9.0 of OS4ED's openSIS Classic has a broken access control vulnerability in the database backup functionality.CVE-2023-38880 · Other software · Os4ed · reported by MITRECritical 9.8
The Community Edition version 9.0 of OS4ED's openSIS Classic has a broken access control vulnerability in the database backup functionality. Whenever an admin generates a database backup, the backup is stored in the web root while the file name has a format of "opensisBackup<date>.sql" (e.g. "opensisBackup07-20-2023.sql"), i.e. can easily be guessed. This file can be accessed by any unauthenticated actor and contains a dump of the whole database including password hashes.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023fast-jwt provides fast JSON Web Token (JWT) implementation.CVE-2023-48223 · Other software · nearform · reported by GitHubMedium 5.9
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algorithm confusion for all public key types. The 'publicKeyPemMatcher' in 'fast-jwt/src/crypto.js' does not properly match all common PEM formats for public keys. To exploit this vulnerability, an attacker needs to craft a malicious JWT token containing the HS256 algorithm, signed with the public RSA key of the victim application. This attack will only work if the victim application utilizes a public key containing the `BEGIN RSA PUBLIC KEY` header. Applications using the RS256 algorithm, a public key with a `BEGIN RSA PUBLIC KEY` header, and calling the verify function without explicitly providing an algorithm, are vulnerable to this algorithm confusion attack which allows attackers to sign arbitrary payloads which will be accepted by the verifier. Version 3.3.2 contains a patch for this issue. As a workaround, change line 29 of `blob/master/src/crypto.js` to include a regular expression.
- Product
- fast-jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2023joaquimserafim/json-web-token is a javascript library use to interact with JSON Web Tokens (JWT) which are a compact URL-safe means of representing claims to beCVE-2023-48238 · Other software · joaquimserafim · reported by GitHubHigh 7.5
joaquimserafim/json-web-token is a javascript library use to interact with JSON Web Tokens (JWT) which are a compact URL-safe means of representing claims to be transferred between two parties. Versions prior to 4.0.0 are vulnerable to a JWT algorithm confusion attack. On line 86 of the 'index.js' file, the algorithm to use for verifying the signature of the JWT token is taken from the JWT token, which at that point is still unverified and thus shouldn't be trusted. To exploit this vulnerability, an attacker needs to craft a malicious JWT token containing the HS256 algorithm, signed with the public RSA key of the victim application. This attack will only work against this library is the RS256 algorithm is in use, however it is a best practice to use that algorithm. Version 4.0.0 fixes the issue.
- Product
- json-web-token
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2023Cross-Site Request Forgery (CSRF) vulnerability in DedeCMS v5.7 in 110 backend management interface via /catalog_add.php, allows attackers to create crafted webCVE-2023-43275 · Other software · dedecms · reported by MITREHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in DedeCMS v5.7 in 110 backend management interface via /catalog_add.php, allows attackers to create crafted web pages due to a lack of verification of the token value of the submitted form.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2023An issue in PublicCMS v.4.0.202302.e allows a remote attacker to obtain sensitive information via the appToken and Parameters parameter of the api/method/getHtmCVE-2023-48204 · Other software · Publiccms · reported by MITREMedium 6.5
An issue in PublicCMS v.4.0.202302.e allows a remote attacker to obtain sensitive information via the appToken and Parameters parameter of the api/method/getHtml component.
- Product
- Publiccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2023An issue discovered in OpenCart 4.0.0.0 to 4.0.2.3 allows authenticated backend users having common/security write privilege can write arbitrary untrusted data CVE-2023-47444 · Other software · Opencart · reported by MITREHigh 8.8
An issue discovered in OpenCart 4.0.0.0 to 4.0.2.3 allows authenticated backend users having common/security write privilege can write arbitrary untrusted data inside config.php and admin/config.php, resulting in remote code execution on the underlying server.
- Product
- Opencart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2023The Pimcore Admin Classic Bundle provides a Backend UI for Pimcore.CVE-2023-47636 · Other software · pimcore · reported by GitHubMedium 5.3
The Pimcore Admin Classic Bundle provides a Backend UI for Pimcore. Full Path Disclosure (FPD) vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the load_file() (within a SQL Injection) query to view the page source, require the attacker to have the full path to the file they wish to view. In the case of pimcore, the fopen() function here doesn't have an error handle when the file doesn't exist on the server so the server response raises the full path "fopen(/var/www/html/var/tmp/export-{ uniqe id}.csv)". This issue has been patched in commit `10d178ef771` which has been included in release version 1.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- admin-ui-classic-bundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Failure to validate the value in APCB may allow a privileged attacker to tamper with the APCB token to force an out-of-bounds memory read potentially resulting CVE-2021-26345 · Other software · AMD · reported by psirt@amd.comLow 1.9
Failure to validate the value in APCB may allow a privileged attacker to tamper with the APCB token to force an out-of-bounds memory read potentially resulting in a denial of service.
- Product
- 2nd Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2023An issue in Yasukawa memberscard v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.CVE-2023-45560 · Other software · Memberscard Project · reported by MITREHigh 7.5
An issue in Yasukawa memberscard v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.
- Product
- Memberscard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2023An issue in Golden v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.CVE-2023-45558 · Other software · golden_project · reported by MITREHigh 7.5
An issue in Golden v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.
- Product
- golden
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2023 IBM CICS TX Advanced 10.1 does not set the secure attribute on authorization tokens or session cookies.CVE-2023-38363 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM CICS TX Advanced 10.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 260818.
- Product
- CICS TX Advanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.