Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,937 results · page 57 of 99
Aug 7, 2023SAP PowerDesigner - version 16.7, queries all password hashes in the backend database and compares it with the user provided one during login attempt, which migCVE-2023-37484 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP PowerDesigner - version 16.7, queries all password hashes in the backend database and compares it with the user provided one during login attempt, which might allow an attacker to access password hashes from the client's memory.
- Product
- SAP PowerDesigner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2023 NVIDIA Omniverse Workstation Launcher for Windows and Linux contains a vulnerability in the authentication flow, where a user’s access token is displayed in thCVE-2023-25524 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 4
NVIDIA Omniverse Workstation Launcher for Windows and Linux contains a vulnerability in the authentication flow, where a user’s access token is displayed in the browser user's address bar. An attacker could use this token to impersonate the user to access launcher resources. A successful exploit of this vulnerability may lead to information disclosure.
- Product
- Omniverse Workstation Launcher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Aug 3, 2023 A broken access control was found allowing for privileged escalation of the operator account to gain administrator privileges.CVE-2023-21407 · Other software · Axis Communications AB · reported by product-security@axis.comHigh 8.8
A broken access control was found allowing for privileged escalation of the operator account to gain administrator privileges.
- Product
- AXIS License Plate Verifier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2023Control ID IDSecure 4.7.26.0 and prior uses a hardcoded cryptographic key in order to sign and verify JWT session tokens, allowing attackers to sign arbitrary sCVE-2023-33371 · Other software · Assaabloy · reported by MITRECritical 9.8
Control ID IDSecure 4.7.26.0 and prior uses a hardcoded cryptographic key in order to sign and verify JWT session tokens, allowing attackers to sign arbitrary session tokens and bypass authentication.
- Product
- Control ID Idsecure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclaroty.comcontrolid.com.br
Aug 2, 2023Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service.CVE-2023-26451 · Other software · OX Software GmbH · reported by security@open-xchange.comHigh 7.5
Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be used to intercept and take over the client authorization process. As a result, other users accounts could be compromised. The oAuth Authorization Service is not enabled by default. We have updated the implementation to use sources with sufficient randomness to generate authorization tokens. No publicly available exploits are known.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 2, 2023In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend.CVE-2023-26442 · Other software · OX Software GmbH · reported by security@open-xchange.comLow 3.2
In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend. An attacker with access to a local or restricted network with the capability to intercept and replay HTTP requests to sproxyd (or who is in control of the sproxyd service) could perform a server-side request-forgery attack and make Cacheservice connect to unexpected resources. We have disabled the ability to follow HTTP redirects when connecting to sproxyd resources. No publicly available exploits are known.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 1, 2023Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized access to user sessions.CVE-2023-38357 · Other software · RWS · reported by MITREMedium 5.3
Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized access to user sessions.
- Product
- Worldserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 25, 2023In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account accessCVE-2023-39173 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account access
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Jul 19, 2023 Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding account’s JWT token only.CVE-2023-35134 · Other software · Weintek · reported by ics-cert@hq.dhs.govHigh 7.4
Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding account’s JWT token only.
- Product
- Weincloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2023 Weintek Weincloud v0.13.6 could allow an attacker to cause a denial-of-service condition for Weincloud by sending a forged JWT token.CVE-2023-34429 · Other software · Weintek · reported by ics-cert@hq.dhs.govHigh 7.5
Weintek Weincloud v0.13.6 could allow an attacker to cause a denial-of-service condition for Weincloud by sending a forged JWT token.
- Product
- Weincloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2023Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created.CVE-2023-3591 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.8
Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jul 13, 2023An issue found in Marui Co Marui Official app v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniCVE-2023-31823 · Other software · Marui · reported by MITREHigh 7.5
An issue found in Marui Co Marui Official app v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Marui Official Store function.
- Product
- Marui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2023An issue found in Inageya v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Inageya functionCVE-2023-31825 · Other software · Inageya · reported by MITREHigh 7.5
An issue found in Inageya v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Inageya function.
- Product
- Inageya
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2023An issue found in Entetsu Store v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Entetsu StCVE-2023-31822 · Other software · Entetsu · reported by MITREHigh 7.5
An issue found in Entetsu Store v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Entetsu Store function.
- Product
- Entetsu Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2023An issue found in Shizutetsu Store v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp functioCVE-2023-31820 · Other software · Shizutetsu · reported by MITREHigh 7.5
An issue found in Shizutetsu Store v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp function.
- Product
- Shizutetsu Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023Pimcore Admin Classic Bundle provides a Backend UI for Pimcore based on the ExtJS framework.CVE-2023-37280 · Other software · pimcore · reported by GitHubMedium 5
Pimcore Admin Classic Bundle provides a Backend UI for Pimcore based on the ExtJS framework. An admin who has not setup two factor authentication before is vulnerable for this attack, without need for any form of privilege, causing the application to execute arbitrary scripts/HTML content. This vulnerability has been patched in version 1.0.3.
- Product
- admin-ui-classic-bundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023An issue found in Marukyu Line v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp function.CVE-2023-31818 · Other software · Marukyu · reported by MITREHigh 7.5
An issue found in Marukyu Line v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp function.
- Product
- Marukyu Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023An authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0.2.CVE-2023-22844 · Other software · Milesight · reported by talos-cna@cisco.comHigh 7.3
An authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0.2. A specially-crafted network request can lead to authentication bypass. An attacker can send a network request to trigger this vulnerability.
- Product
- MilesightVPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jul 3, 2023 The affected TBox RTUs allow low privilege users to access software security tokens of higher privilege.CVE-2023-36611 · Other software · Ovarro · reported by ics-cert@hq.dhs.govMedium 6.5
The affected TBox RTUs allow low privilege users to access software security tokens of higher privilege. This could allow an attacker with “user” privileges to access files requiring higher privileges by establishing an SSH session and providing the other tokens.
- Product
- TBox MS-CPU32
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2023 The affected TBox RTUs generate software security tokens using insufficient entropy.CVE-2023-36610 · Other software · Ovarro · reported by ics-cert@hq.dhs.govMedium 5.9
The affected TBox RTUs generate software security tokens using insufficient entropy. The random seed used to generate the software tokens is not initialized correctly, and other parts of the token are generated using predictable time-based values. An attacker with this knowledge could successfully brute force the token and authenticate themselves.
- Product
- TBox MS-CPU32
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2023An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow an attacker to carry out an impersonatioCVE-2023-22814 · Network & remote access · Western Digital · reported by psirt@wdc.comCritical 10
An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow an attacker to carry out an impersonation attack. This issue affects My Cloud OS 5 devices: before 5.26.202.
- Product
- My Cloud OS 5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwesterndigital.comwesterndigital.com
Jun 30, 2023Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other CVE-2023-3485 · Other software · Temporal Technologies Inc. · reported by security@temporal.ioLow 3
Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request. Creation of this task token must be done outside of the normal Temporal server flow. It requires the namespace UUID and information from the workflow history for the target namespace. Under these conditions, it is possible to interfere with pending tasks in other namespaces, such as marking a task failed or completed. If a task is targeted for completion by the attacker, the targeted namespace must also be using the same data converter configuration as the initial, valid, namespace for the task completion payload to be decoded by workers in the target namespace.
- Product
- Temporal Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2023Web3 – Crypto wallet Login & NFT token gating: Authentication bypassCVE-2023-3249 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hidden_form_data' function. This makes it possible for authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
- Product
- Web3 – Crypto wallet Login & NFT token gating
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update Web3 – Crypto wallet Login & NFT token gating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 29, 2023A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data.CVE-2023-36347 · Other software · Codekop · reported by MITREHigh 7.5
A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data.
- Product
- Codekop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyoutube.comyuyudhn.github.io
Jun 28, 2023Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.CVE-2023-36475 · Other software · parse-community · reported by GitHubCritical 9.8
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A patch is available in versions 5.5.2 and 6.2.1.
- Product
- parse-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2023There is a storage type cross site scripting (XSS) vulnerability in the filing number of the Basic Information tab on the backend management page of EyouCMS v1.CVE-2023-36093 · Other software · Eyoucms · reported by MITREMedium 5.4
There is a storage type cross site scripting (XSS) vulnerability in the filing number of the Basic Information tab on the backend management page of EyouCMS v1.6.3
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2023Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 versions allows any loCVE-2023-35093 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 versions allows any logged-in users, such as subscribers to view the "Orders" of the plugin and get the data related to the order like email, username, and more.
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 20, 2023Cross Site Request Forgery found in yzCMS v.2.0 allows a remote attacker to execute arbitrary code via the token check function.CVE-2020-20502 · Other software · Yzmcms · reported by MITREMedium 6.5
Cross Site Request Forgery found in yzCMS v.2.0 allows a remote attacker to execute arbitrary code via the token check function.
- Product
- Yzmcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity sCVE-2023-35854 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they have "found no evidence or detail of a security vulnerability."
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commanageengine.com
Jun 19, 2023A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below version 30.CVE-2023-25747 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.5
A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below version 30. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox for Android < 110.1.0.
- Product
- Firefox for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jun 18, 2023packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow ..CVE-2023-35844 · Other software · Lightdash · reported by MITREHigh 7.5
packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension (.csv or .png) is used.
- Product
- Lightdash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisory.dw1.iogithub.com
Jun 16, 2023A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to send crafted TCP packets containing requestCVE-2023-30223 · Other software · 4d · reported by MITREHigh 7.5
A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to send crafted TCP packets containing requests to perform arbitrary actions.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.4d.compacketstormsecurity.com
Jun 15, 2023Broken access control in the Registration page (/Registration.aspx) of Termenos CWX v8.5.6 allows attackers to access sensitive information.CVE-2023-34797 · Other software · Temenos · reported by MITREMedium 5.4
Broken access control in the Registration page (/Registration.aspx) of Termenos CWX v8.5.6 allows attackers to access sensitive information.
- Product
- CWX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023cpdb-libs provides frontend and backend libraries for the Common Printing Dialog Backends (CPDB) project.CVE-2023-34095 · Other software · OpenPrinting · reported by GitHubCritical 9.8
cpdb-libs provides frontend and backend libraries for the Common Printing Dialog Backends (CPDB) project. In versions 1.0 through 2.0b4, cpdb-libs is vulnerable to buffer overflows via improper use of `scanf(3)`. cpdb-libs uses the `fscanf()` and `scanf()` functions to parse command lines and configuration files, dropping the read string components into fixed-length buffers, but does not limit the length of the strings to be read by `fscanf()` and `scanf()` causing buffer overflows when a string is longer than 1023 characters. A patch for this issue is available at commit f181bd1f14757c2ae0f17cc76dc20421a40f30b7. As all buffers have a length of 1024 characters, the patch limits the maximum string length to be read to 1023 by replacing all occurrences of `%s` with `%1023s` in all calls of the `fscanf()` and `scanf()` functions.
- Product
- cpdb-libs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Jun 14, 2023An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip.CVE-2023-34878 · Other software · Ujcms · reported by MITREHigh 7.5
An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip.
- Product
- Ujcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload.CVE-2023-34747 · Other software · Ujcms · reported by MITRECritical 9.8
File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload.
- Product
- Ujcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2023GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded.CVE-2023-33621 · Other software · Gl-inet · reported by MITREMedium 5.9
GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded. The token is then left in the browser history or access logs, potentially allowing attackers to bypass authentication via session replay.
- Product
- Gl-ar750s Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjustinapplegate.mejustinapplegate.me
Jun 13, 2023A use of a broken or risky cryptographic algorithm [CWE-327] in Fortinet FortiSIEM before 6.7.1 allows a remote unauthenticated attacker to perform brute forceCVE-2022-43949 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 6.2
A use of a broken or risky cryptographic algorithm [CWE-327] in Fortinet FortiSIEM before 6.7.1 allows a remote unauthenticated attacker to perform brute force attacks on GUI endpoints via taking advantage of outdated hashing methods.
- Product
- FortiSIEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Jun 12, 2023An issue was discovered in freakchicken kafkaUI-lite 1.2.11 allows attackers on the same network to gain escalated privileges for the nodes running on it.CVE-2023-27716 · Other software · Kafkaui-lite Project · reported by MITRECritical 9.8
An issue was discovered in freakchicken kafkaUI-lite 1.2.11 allows attackers on the same network to gain escalated privileges for the nodes running on it.
- Product
- Kafkaui-lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2023Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends.CVE-2023-34096 · Other software · sni · reported by GitHubMedium 6.5
Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends. In versions 3.06 and prior, the file `panorama.pm` is vulnerable to a Path Traversal vulnerability which allows an attacker to upload a file to any folder which has write permissions on the affected system. The parameter location is not filtered, validated or sanitized and it accepts any kind of characters. For a path traversal attack, the only characters required were the dot (`.`) and the slash (`/`). A fix is available in version 3.06.2.
- Product
- Thruk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgalogetlatorre.blogspot.com
Jun 7, 2023 IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 does not set the secure attribute on authorization tokenCVE-2023-33847 · Other software · IBM · reported by psirt@us.ibm.comLow 3.7
IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 257102.
- Product
- TXSeries for Multiplatforms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 7, 2023 PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site request forgery attack or a replay atCVE-2023-31200 · Other software · PTC · reported by ics-cert@hq.dhs.govMedium 5.7
PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site request forgery attack or a replay attack.
- Product
- Vuforia Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2023Kubernetes secrets-store-csi-driver in versions before 1.3.3 discloses service account tokens in logs.CVE-2023-2878 · Other software · Kubernetes · reported by jordan@liggitt.netMedium 6.5
Kubernetes secrets-store-csi-driver in versions before 1.3.3 discloses service account tokens in logs.
- Product
- secrets-store-csi-driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Jun 5, 2023The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML documentCVE-2023-34411 · Other software · XML Library Project · reported by MITREHigh 7.5
The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document. The earliest affected version is 0.8.9.
- Product
- XML Library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2023A vulnerability was found in Broken Link Checker Plugin up to 1.10.1 on WordPress.CVE-2014-125105 · WordPress plugins & themes · reported by VulDBLow 2.4
A vulnerability was found in Broken Link Checker Plugin up to 1.10.1 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function options_page of the file core/core.php of the component Settings Page. The manipulation of the argument exclusion_list/blc_custom_fields leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.10.2 is able to address this issue. The patch is named 90615fe9b0b6f9e6fb254d503c302e53a202e561. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230659.
- Product
- Broken Link Checker
- Affected
- up to 1.10.1
- What to do
- Affects up to 1.10.1. Update Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 2, 2023Improper Limitation of a Pathname leads to a Path Traversal vulnerability in the module King-Avis for Prestashop, allowing a user knowing the download token to CVE-2023-3031 · Other software · Webbax · reported by vulnerability@ncsc.chMedium 4.9
Improper Limitation of a Pathname leads to a Path Traversal vulnerability in the module King-Avis for Prestashop, allowing a user knowing the download token to read arbitrary local files.This issue affects King-Avis: before 17.3.15.
- Product
- King-Avis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordborelenzo.github.ioborelenzo.github.io
Jun 2, 2023OMICARD EDM backend system’s file uploading function does not restrict upload of file with dangerous type.CVE-2023-28700 · Other software · ITPison · reported by twcert@cert.org.twMedium 6.8
OMICARD EDM backend system’s file uploading function does not restrict upload of file with dangerous type. A local area network attacker with administrator privileges can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service.
- Product
- OMICARD EDM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jun 1, 2023Insufficient authentication in the MQTT backend (broker) allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles usiCVE-2023-3028 · Other software · Hangzhou Hopechart IoT Technology Co., Ltd. · reported by cve@asrg.ioHigh 8.6
Insufficient authentication in the MQTT backend (broker) allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles using the HopeChart HQT-401 telematics unit. Other models are possibly affected too. Multiple vulnerabilities were identified: - The MQTT backend does not require authentication, allowing unauthorized connections from an attacker. - The vehicles publish their telemetry data (e.g. GPS Location, speed, odometer, fuel, etc) as messages in public topics. The backend also sends commands to the vehicles as MQTT posts in public topics. As a result, an attacker can access the confidential data of the entire fleet that is managed by the backend. - The MQTT messages sent by the vehicles or the backend are not encrypted or authenticated. An attacker can create and post messages to impersonate a vehicle or the backend. The attacker could then, for example, send incorrect information to the backend about the vehicle's location. - The backend can inject data into a vehicle´s CAN bus by sending a specific MQTT message on a public topic. Because these messages are not authenticated or encrypted, an attacker could impersonat
- Product
- HQT401
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.CVE-2023-32689 · Other software · parse-community · reported by GitHubMedium 6.3
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 5.4.4 and 6.1.1 are vulnerable to a phishing attack vulnerability that involves a user uploading malicious files. A malicious user could upload an HTML file to Parse Server via its public API. That HTML file would then be accessible at the internet domain at which Parse Server is hosted. The URL of the the uploaded HTML could be shared for phishing attacks. The HTML page may seem legitimate because it is served under the internet domain where Parse Server is hosted, which may be the same as a company's official website domain. An additional security issue arises when the Parse JavaScript SDK is used. The SDK stores sessions in the internet browser's local storage, which usually restricts data access depending on the internet domain. A malicious HTML file could contain a script that retrieves the user's session token from local storage and then share it with the attacker. The fix included in versions 5.4.4 and 6.1.1 adds a new Parse Server option `fileUpload.fileExtensions` to restrict file upload on Parse Server by file extension. It is recommended to restrict
- Product
- parse-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2023OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renaming tokens.CVE-2023-24605 · Other software · Open-xchange · reported by MITREMedium 4.2
OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renaming tokens.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgopen-xchange.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.