Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,938 results · page 55 of 99
Nov 11, 2023Headscale through 0.22.3 writes bearer tokens to info-level logs.CVE-2023-47390 · Other software · Juanfont · reported by MITREHigh 7.5
Headscale through 0.22.3 writes bearer tokens to info-level logs.
- Product
- Headscale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Kenth Hagström WP-Cache.Com plugin <= 1.1.1 versions.CVE-2023-34177 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Kenth Hagström WP-Cache.Com plugin <= 1.1.1 versions.
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 9, 2023The leakage of channel access token in DRAGON FAMILY Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47373 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in DRAGON FAMILY Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in UPDATESALON C-LOUNGE Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47372 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in UPDATESALON C-LOUNGE Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in bluetrick Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47370 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in bluetrick Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in taketorinoyu Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47368 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in taketorinoyu Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and used to impersonateCVE-2023-41137 · Other software · AppsAnywhere · reported by info@appcheck-ng.comHigh 8
Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and used to impersonate the AppsAnywhere server.
- Product
- AppsAnywhere Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.appsanywhere.comdocs.appsanywhere.com
Nov 9, 2023The leakage of channel access token in best_training_member Line 13.6.1 allows remote attackers to send malicious notifications.CVE-2023-47369 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in best_training_member Line 13.6.1 allows remote attackers to send malicious notifications.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in platinum clinic Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47367 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in platinum clinic Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in craft_members Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47366 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in craft_members Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in Lil.OFF-PRICE STORE Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47365 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in Lil.OFF-PRICE STORE Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in nagaoka taxi Line 13.6.1 allows remote attackers to send malicious notifications to victimsCVE-2023-47364 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in nagaoka taxi Line 13.6.1 allows remote attackers to send malicious notifications to victims
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in F.B.P members Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47363 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in F.B.P members Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2023An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for everyCVE-2023-45857 · Other software · Axios · reported by MITREMedium 6.5
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
- Product
- Axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
Nov 7, 2023Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations.CVE-2023-5309 · Other software · Puppet · reported by security@puppet.comMedium 6.8
Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations.
- Product
- Puppet Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2023Subrion 4.2.1 has a remote command execution vulnerability in the backend.CVE-2023-46947 · Other software · subrion · reported by MITREHigh 8.8
Subrion 4.2.1 has a remote command execution vulnerability in the backend.
- Product
- subrion_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2023ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its check token module.CVE-2023-41347 · Network & remote access · ASUS · reported by twcert@cert.org.twHigh 8.8
ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its check token module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services.
- Product
- RT-AX55
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 3, 2023ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-refresh module.CVE-2023-41346 · Network & remote access · ASUS · reported by twcert@cert.org.twHigh 8.8
ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-refresh module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services.
- Product
- RT-AX55
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 3, 2023ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-generated module.CVE-2023-41345 · Network & remote access · ASUS · reported by twcert@cert.org.twHigh 8.8
ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-generated module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system, or terminate services.
- Product
- RT-AX55
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 2, 2023An information leak in hirochanKAKIwaiting v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39057 · Other software · Lycorp · reported by MITREHigh 7.5
An information leak in hirochanKAKIwaiting v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- Product
- Line Mini App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Nov 2, 2023An information leak in Tokudaya.ekimae_mc v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39054 · Other software · Lycorp · reported by MITREHigh 7.5
An information leak in Tokudaya.ekimae_mc v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- Product
- Line Mini App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Nov 2, 2023An information leak in Hattoriya v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39053 · Other software · Lycorp · reported by MITREHigh 7.5
An information leak in Hattoriya v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- Product
- Line Mini App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Nov 2, 2023An information leak in VISION MEAT WORKS Track Diner 10/10mbl v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39051 · Other software · Lycorp · reported by MITREHigh 7.5
An information leak in VISION MEAT WORKS Track Diner 10/10mbl v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- Product
- Line Mini App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Nov 2, 2023An information leak in Daiky-value.Fukueten v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39050 · Other software · Lycorp · reported by MITREHigh 7.5
An information leak in Daiky-value.Fukueten v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- Product
- Line Mini App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Nov 2, 2023An information leak in Tokudaya.honten v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39048 · Other software · Lycorp · reported by MITREHigh 7.5
An information leak in Tokudaya.honten v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- Product
- Line Mini App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Nov 2, 2023An information leak in shouzu sweets oz v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39047 · Other software · Lycorp · reported by MITREHigh 7.5
An information leak in shouzu sweets oz v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- Product
- Line Mini App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Nov 2, 2023An information leak in Gyouza-newhushimi v13.6.1 allows attackers to obtain the channel access token and send crafted messages.CVE-2023-39042 · Other software · Lycorp · reported by MITREHigh 7.5
An information leak in Gyouza-newhushimi v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- Product
- Line Mini App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Nov 2, 2023Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token.CVE-2023-31579 · Other software · Tangyh · reported by MITRECritical 9.8
Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows attackers to authenticate to the application via a crafted JWT token.
- Product
- Lamp-cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2023There is a Cross Site Scripting (XSS) vulnerability in the choose_style_tree.do interface of Jspxcms v10.2.0 backend.CVE-2023-46911 · Other software · Jspxcms · reported by MITREMedium 6.1
There is a Cross Site Scripting (XSS) vulnerability in the choose_style_tree.do interface of Jspxcms v10.2.0 backend.
- Product
- Jspxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023The Pimcore Admin Classic Bundle provides a backend UI for Pimcore.CVE-2023-46722 · Other software · pimcore · reported by GitHubMedium 6.1
The Pimcore Admin Classic Bundle provides a backend UI for Pimcore. Prior to version 1.2.0, a cross-site scripting vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Users should upgrade to version 1.2.0 to receive a patch or, as a workaround, apply the patch manually.
- Product
- admin-ui-classic-bundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is diffCVE-2015-20110 · Other software · Jhipster · reported by MITREHigh 7.5
JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces the search space to a linear amount of guesses based on the token length times the possible characters.
- Product
- Jhipster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023In User Backup Manager, there is a possible way to leak a token to bypass user confirmation for backup due to log information disclosure.CVE-2023-21387 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.4
In User Backup Manager, there is a possible way to leak a token to bypass user confirmation for backup due to log information disclosure. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 27, 2023 Due to inadequate code logic, a previously unauthenticated threat actor could potentially obtain a local Windows OS user token through the FactoryTalk® ServiceCVE-2023-46290 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.1
Due to inadequate code logic, a previously unauthenticated threat actor could potentially obtain a local Windows OS user token through the FactoryTalk® Services Platform web service and then use the token to log in into FactoryTalk® Services Platform . This vulnerability can only be exploited if the authorized user did not previously log in into the FactoryTalk® Services Platform web service.
- Product
- FactoryTalk® Services Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.custhelp.comrockwellautomation.custhelp.com
Oct 27, 2023VMware Tools contains a SAML token signature bypass vulnerability.CVE-2023-34058 · Other software · VMware · reported by security@vmware.comHigh 7.1
VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .
- Product
- Open VM Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.debian.org
Oct 26, 2023Secret token configuration is never applied when using ECK <2.8 with APM Server >=8.0.CVE-2023-31416 · Other software · Elastic · reported by security@elastic.coMedium 5.3
Secret token configuration is never applied when using ECK <2.8 with APM Server >=8.0. This could lead to anonymous requests to an APM Server being accepted and the data ingested into this APM deployment.
- Product
- Elastic Cloud on Kubernetes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.coelastic.co
Oct 25, 2023An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text.CVE-2023-46667 · Other software · Elastic · reported by security@elastic.coHigh 8.1
An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow someone to enrol an agent into an agent policy, and potentially use that to retrieve other secrets in the policy including for Elasticsearch and third-party services. Alternatively a threat actor could potentially enrol agents to the clusters and send arbitrary events to Elasticsearch.
- Product
- Fleet Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.coelastic.co
Oct 25, 2023Incorrect access control in writercms v1.1.0 allows attackers to directly obtain backend account passwords via unspecified vectors.CVE-2023-43905 · Other software · writercms · reported by MITREHigh 7.5
Incorrect access control in writercms v1.1.0 allows attackers to directly obtain backend account passwords via unspecified vectors.
- Product
- writercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023Jenkins Zanata Plugin 0.6 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token hashes are equaCVE-2023-46660 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.3
Jenkins Zanata Plugin 0.6 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token hashes are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token.
- Product
- Jenkins Zanata Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Oct 25, 2023Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potCVE-2023-46657 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.3
Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token.
- Product
- Jenkins Gogs Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Oct 25, 2023Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level, potentially resulting in its exposure.CVE-2023-46653 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level, potentially resulting in its exposure.
- Product
- Jenkins lambdatest-automation Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Oct 25, 2023Mercury A15 V1.0 20230818_1.0.3 was discovered to contain a command execution vulnerability via the component cloudDeviceTokenSuccCB.CVE-2023-46518 · Other software · mercury · reported by MITRECritical 9.8
Mercury A15 V1.0 20230818_1.0.3 was discovered to contain a command execution vulnerability via the component cloudDeviceTokenSuccCB.
- Product
- a15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comservice.mercurycom.com.cn
Oct 25, 2023Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.CVE-2023-46119 · Other software · parse-community · reported by GitHubHigh 7.5
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading a file without extension. This vulnerability has been patched in versions 5.5.6 and 6.3.1.
- Product
- parse-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL.CVE-2023-44794 · Other software · dromara · reported by MITRECritical 9.8
An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL.
- Product
- sa-token
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass.CVE-2023-43961 · Other software · dromara · reported by MITREHigh 8.8
An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
- Product
- sa-token
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023The leakage of the client secret in Onigiriya-musubee Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.CVE-2023-39740 · Other software · Linecorp · reported by MITREHigh 8.2
The leakage of the client secret in Onigiriya-musubee Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
- Product
- Onigiriya-musubee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Oct 25, 2023The leakage of the client secret in REGINA SWEETS&BAKERY Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.CVE-2023-39739 · Other software · linecorp · reported by MITREHigh 8.2
The leakage of the client secret in REGINA SWEETS&BAKERY Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
- Product
- regina_sweets\&bakery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Oct 25, 2023The leakage of the client secret in Matsuya Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.CVE-2023-39737 · Other software · linecorp · reported by MITREHigh 8.2
The leakage of the client secret in Matsuya Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
- Product
- matsuya
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Oct 25, 2023The leakage of the client secret in Fukunaga_memberscard Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.CVE-2023-39736 · Other software · linecorp · reported by MITREHigh 8.2
The leakage of the client secret in Fukunaga_memberscard Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
- Product
- fukunaga_memberscard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Oct 25, 2023The leakage of the client secret in Uomasa_Saiji_news Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.CVE-2023-39735 · Other software · linecorp · reported by MITREHigh 8.2
The leakage of the client secret in Uomasa_Saiji_news Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
- Product
- uomasa_saiji_new
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Oct 25, 2023The leakage of the client secret in VISION MEAT WORKS TrackDiner10/10_mc Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadCVE-2023-39734 · Other software · Linecorp · reported by MITREHigh 8.2
The leakage of the client secret in VISION MEAT WORKS TrackDiner10/10_mc Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
- Product
- Trackdiner10/10 MC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comliff.line.me
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.