Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

436 results · page 6 of 9

Apr 10, 2024Elementor Addons by Livemesh: Stored Cross-Site ScriptingCVE-2024-2655 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post widgets in all versions up to, and including, 8.3.5 due to insufficient input sanitization and output escaping on author display names. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addons by Livemesh
Affected
up to 8.3.5
What to do
Affects up to 8.3.5. Update Elementor Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 10, 2024Elementor Addons by Livemesh: Stored Cross-Site ScriptingCVE-2024-2539 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget '_id' attributes in all versions up to, and including, 8.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addons by Livemesh
Affected
up to 8.3.6
What to do
Affects up to 8.3.6. Update Elementor Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Elementor Addons by Livemesh: Stored Cross-Site ScriptingCVE-2024-1466 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slider_style’ attribute of the Posts Multislider widget in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-27986 may be a duplicate of this issue.
Product
Elementor Addons by Livemesh
Affected
up to 8.3.4
What to do
Affects up to 8.3.4. Update Elementor Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Elementor Addons by Livemesh: Stored Cross-Site ScriptingCVE-2024-1465 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘carousel_skin’ attribute of the Posts Carousel widget in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addons by Livemesh
Affected
up to 8.3.4
What to do
Affects up to 8.3.4. Update Elementor Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Elementor Addons by Livemesh: Stored Cross-Site ScriptingCVE-2024-1464 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ attribute of the Posts Slider widget in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addons by Livemesh
Affected
up to 8.3.4
What to do
Affects up to 8.3.4. Update Elementor Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Elementor Addons by Livemesh: Stored Cross-Site ScriptingCVE-2024-1461 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ attribute of the Team Members widget in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addons by Livemesh
Affected
up to 8.3.4
What to do
Affects up to 8.3.4. Update Elementor Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Elementor Addons by Livemesh: Stored Cross-Site ScriptingCVE-2024-1458 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘text_alignment’ attribute of the Animated Text widget in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addons by Livemesh
Affected
up to 8.3.4
What to do
Affects up to 8.3.4. Update Elementor Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 3, 2024An issue in D-Link COVR 1100, 1102, 1103 AC1200 Dual-Band Whole-Home Mesh Wi-Fi System (Hardware Rev B1) truncates Wireless Access Point Passwords (WPA-PSK) allCVE-2023-52043 · Other software · dlink · reported by MITREHigh 8.1
An issue in D-Link COVR 1100, 1102, 1103 AC1200 Dual-Band Whole-Home Mesh Wi-Fi System (Hardware Rev B1) truncates Wireless Access Point Passwords (WPA-PSK) allowing an attacker to gain unauthorized network access via weak authentication controls.
Product
covr_1100
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploots.github.io exploots.github.io
Mar 27, 2024Livemesh Addons for WPBakery Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30183 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh Livemesh Addons for WPBakery Page Builder allows Stored XSS.This issue affects Livemesh Addons for WPBakery Page Builder: from n/a through 3.7.
Product
Livemesh Addons for WPBakery Page Builder
Affected
up to 3.7
What to do
Affects up to 3.7. Update Livemesh Addons for WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications.CVE-2024-29031 · Other software · meshery · reported by GitHubHigh 7.5
Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.17 allows a remote attacker to obtain sensitive information via the `order` parameter of `GetMeshSyncResources`. Version 0.7.17 contains a patch for this issue.
Product
meshery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 15, 2024Livemesh Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-25598 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh Livemesh Addons for Elementor allows Stored XSS.This issue affects Livemesh Addons for Elementor: from n/a through 8.3.
Product
Livemesh Addons for Elementor
Affected
up to 8.3
What to do
Affects up to 8.3. Update Livemesh Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 14, 2024Elementor Addons by Livemesh: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27986 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh Elementor Addons by Livemesh allows Stored XSS.This issue affects Elementor Addons by Livemesh: from n/a through 8.3.5.
Product
Elementor Addons by Livemesh
Affected
up to 8.3.5
What to do
Affects up to 8.3.5. Update Elementor Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2024WPBakery Page Builder Addons by Livemesh: Stored Cross-Site ScriptingCVE-2024-2079 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPBakery Page Builder Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'per_line_mobile' shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPBakery Page Builder Addons by Livemesh
Affected
up to 3.8.1
What to do
Affects up to 3.8.1. Update WPBakery Page Builder Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Elementor Addons by Livemesh: Stored Cross-Site ScriptingCVE-2024-1235 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom class field in all versions up to, and including, 8.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addons by Livemesh
Affected
up to 8.3.2
What to do
Affects up to 8.3.2. Update Elementor Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 20, 2024MeshCentral is a full computer management web site.CVE-2024-26135 · Other software · Ylianst · reported by GitHubHigh 8.3
MeshCentral is a full computer management web site. Versions prior to 1.1.21 a cross-site websocket hijacking (CSWSH) vulnerability within the control.ashx endpoint. This component is the primary mechanism used within MeshCentral to perform administrative actions on the server. The vulnerability is exploitable when an attacker is able to convince a victim end-user to click on a malicious link to a page hosting an attacker-controlled site. The attacker can then originate a cross-site websocket connection using client-side JavaScript code to connect to `control.ashx` as the victim user within MeshCentral. Version 1.1.21 contains a patch for this issue.
Product
MeshCentral
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 15, 2024The 802.11 beacon handling routine failed to validate the length of an IEEE 802.11s Mesh ID before copying it to a heap-allocated buffer.CVE-2022-23088 · Other software · FreeBSD · reported by secteam@freebsd.orgCritical 9.8
The 802.11 beacon handling routine failed to validate the length of an IEEE 802.11s Mesh ID before copying it to a heap-allocated buffer. While a FreeBSD Wi-Fi client is in scanning mode (i.e., not associated with a SSID) a malicious beacon frame may overwrite kernel memory, leading to remote code execution.
Product
FreeBSD
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.freebsd.org security.freebsd.org
Feb 5, 2024Elementor Addons by Livemesh: Stored Cross-Site ScriptingCVE-2024-0448 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget URL parameters in all versions up to, and including, 8.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addons by Livemesh
Affected
up to 8.3.1
What to do
Affects up to 8.3.1. Update Elementor Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 2, 2024Ylianst MeshCentral 1.1.16 suffers from Use of a Broken or Risky Cryptographic Algorithm.CVE-2023-51838 · Other software · Meshcentral · reported by MITREHigh 7.5
Ylianst MeshCentral 1.1.16 suffers from Use of a Broken or Risky Cryptographic Algorithm.
Product
Meshcentral
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 31, 2024Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote authenticated attacCVE-2024-23941 · Other software · Intermesh BV · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product.
Product
Group Office
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com jvn.jp
Jan 29, 2024Ylianst MeshCentral 1.1.16 is vulnerable to Missing SSL Certificate Validation.CVE-2023-51837 · Other software · Meshcentral · reported by MITRECritical 9.8
Ylianst MeshCentral 1.1.16 is vulnerable to Missing SSL Certificate Validation.
Product
Meshcentral
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 29, 2024An algorithm-downgrade issue was discovered in Ylianst MeshCentral 1.1.16.CVE-2023-51842 · Other software · Meshcentral · reported by MITREHigh 7.5
An algorithm-downgrade issue was discovered in Ylianst MeshCentral 1.1.16.
Product
Meshcentral
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 18, 2024Group-Office is an enterprise CRM and groupware tool.CVE-2024-22418 · Other software · Intermesh · reported by GitHubMedium 6.5
Group-Office is an enterprise CRM and groupware tool. Affected versions are subject to a vulnerability which is present in the file upload mechanism of Group Office. It allows an attacker to execute arbitrary JavaScript code by embedding it within a file's name. For instance, using a filename such as “><img src=x onerror=prompt('XSS')>.jpg” triggers the vulnerability. When this file is uploaded, the JavaScript code within the filename is executed. This issue has been addressed in version 6.8.29. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
groupoffice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 17, 2024URL Shortener by MyThemeShop: Missing AuthorizationCVE-2023-23896 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in MyThemeShop URL Shortener by MyThemeShop.This issue affects URL Shortener by MyThemeShop: from n/a through 1.0.17.
Product
URL Shortener by MyThemeShop
Affected
up to 1.0.17
What to do
Affects up to 1.0.17. Update URL Shortener by MyThemeShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 14, 2023WPBakery Page Builder Addons by Livemesh: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50370 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh WPBakery Page Builder Addons by Livemesh allows Stored XSS.This issue affects WPBakery Page Builder Addons by Livemesh: from n/a through 3.5.
Product
WPBakery Page Builder Addons by Livemesh
Affected
up to 3.5
What to do
Affects up to 3.5. Update WPBakery Page Builder Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 7, 2023Tenda W30E V16.01.0.12(4843) contains a stack overflow vulnerability via the function formDeleteMeshNode.CVE-2023-49411 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda W30E V16.01.0.12(4843) contains a stack overflow vulnerability via the function formDeleteMeshNode.
Product
W30e Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 7, 2023Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formRebootMeshNode.CVE-2023-50002 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formRebootMeshNode.
Product
W30e Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 7, 2023Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formUpgradeMeshOnline.CVE-2023-50001 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formUpgradeMeshOnline.
Product
W30e Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 7, 2023Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formResetMeshNode.CVE-2023-50000 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formResetMeshNode.
Product
W30e Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 24, 2023A SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a remote attacker to retrieve sensitive information and execute arbitrary coCVE-2023-46575 · Other software · Layer5 · reported by MITRECritical 9.8
A SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a remote attacker to retrieve sensitive information and execute arbitrary code through the “order” parameter
Product
Meshery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in MyThemeShop WP Shortcode by MyThemeShop plugin <= 1.4.16 versions.CVE-2023-28495 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in MyThemeShop WP Shortcode by MyThemeShop plugin <= 1.4.16 versions.
Affected
up to 1.4.16
What to do
Affects up to 1.4.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Group-Office is an enterprise CRM and groupware tool.CVE-2023-46730 · Other software · Intermesh · reported by GitHubHigh 7.4
Group-Office is an enterprise CRM and groupware tool. In affected versions there is full Server-Side Request Forgery (SSRF) vulnerability in the /api/upload.php endpoint. The /api/upload.php endpoint does not filter URLs which allows a malicious user to cause the server to make resource requests to untrusted domains. Note that protocols like file:// can also be used to access the server disk. The request result (on success) can then be retrieved using /api/download.php. This issue has been addressed in versions 6.8.15, 6.7.54, and 6.6.177. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
groupoffice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 25, 2023TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMeshUploadConfig.CVE-2023-46542 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMeshUploadConfig.
Product
x2000r_firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com totolink.cn
Sep 25, 2023In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionCVE-2023-4258 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8.6
In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionee.
Product
Zephyr
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 23, 2023A content spoofing vulnerability was found in Kiali.CVE-2022-3962 · Other software · Red Hat · reported by Red HatMedium 4.3
A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when the page or endpoint being accessed cannot be found. This issue allows an attacker to perform arbitrary text injection when an error response is retrieved from the URL being accessed.
Product
Red Hat OpenShift Service Mesh 2.3 for RHEL 8
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Aug 9, 2023HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities.CVE-2023-3518 · Other software · HashiCorp · reported by security@hashicorp.comHigh 7.4
HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1.
Product
Consul
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record discuss.hashicorp.com discuss.hashicorp.com
Jul 17, 2023CWE-502 Deserialization of Untrusted Data at the rabbitmq-connector plugin module in Apache EventMesh (incubating) V1.7.0\V1.8.0 on windows\linux\mac os e.g.CVE-2023-26512 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
CWE-502 Deserialization of Untrusted Data at the rabbitmq-connector plugin module in Apache EventMesh (incubating) V1.7.0\V1.8.0 on windows\linux\mac os e.g. platforms allows attackers to send controlled message and remote code execute via rabbitmq messages. Users can use the code under the master branch in project repo to fix this issue, we will release the new version as soon as possible.
Product
Apache EventMesh (incubating) RabbitMQ connector
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
May 3, 2023 When DNS is provisioned, an authenticated remote command execution vulnerability exists in DNS iQuery mesh.CVE-2023-28742 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.2
When DNS is provisioned, an authenticated remote command execution vulnerability exists in DNS iQuery mesh. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Product
BIG-IP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record my.f5.com my.f5.com
Apr 26, 2023Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information CVE-2023-25292 · Other software · Group-office · reported by MITREMedium 6.1
Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information via the GO_LANGUAGE cookie.
Product
Group Office
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 20, 2023A heap-based buffer overflow vulnerability exists in the TriangleMesh clone functionality of Slic3r libslic3r 1.3.0 and Master Commit b1a5500.CVE-2022-36788 · Other software · Slic3r · reported by talos-cna@cisco.comHigh 8.1
A heap-based buffer overflow vulnerability exists in the TriangleMesh clone functionality of Slic3r libslic3r 1.3.0 and Master Commit b1a5500. A specially-crafted STL file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Product
libslic3r
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Apr 17, 2023The TouchDown Timesheet tracking component 4.1.4 for Jira allows XSS in the calendar view.CVE-2022-44726 · Other software · Timesheets-for-jira · reported by MITREMedium 5.4
The TouchDown Timesheet tracking component 4.1.4 for Jira allows XSS in the calendar view.
Product
Timesheet Tracking
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record syss.de syss.de
Apr 3, 2023An improper array index validation vulnerability exists in the stl_fix_normal_directions functionality of ADMesh Master Commit 767a105 and v0.98.4.CVE-2022-38072 · Other software · ADMesh · reported by talos-cna@cisco.comMedium 6.5
An improper array index validation vulnerability exists in the stl_fix_normal_directions functionality of ADMesh Master Commit 767a105 and v0.98.4. A specially-crafted stl file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Product
ADMesh
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com talosintelligence.com
Mar 22, 2023vox2mesh 1.0 has stack-overflow in main.cpp, this is stack-overflow caused by incorrect use of memcpy() funciton.CVE-2023-27754 · Other software · Vox2mesh Project · reported by MITREMedium 5.5
vox2mesh 1.0 has stack-overflow in main.cpp, this is stack-overflow caused by incorrect use of memcpy() funciton. The flow allows an attacker to cause a denial of service (abort) via a crafted file.
Product
Vox2mesh
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 13, 2023 STEPTools v18SP1 ifcmesh library (v18.1) is affected due to a null pointer dereference, which could allow an attacker to deny application usage when reading a CVE-2023-0973 · Other software · Step Tools · reported by ics-cert@hq.dhs.govLow 2.2
STEPTools v18SP1 ifcmesh library (v18.1) is affected due to a null pointer dereference, which could allow an attacker to deny application usage when reading a specially constructed file, resulting in an application crash.
Product
v18SP1 ifcmesh library
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Feb 22, 2023Aztech WMB250AC Mesh Routers Firmware Version 016 2020 devices improperly manage sessions, which allows remote attackers to bypass authentication in opportunistCVE-2022-45600 · Other software · Aztech · reported by MITREHigh 8.8
Aztech WMB250AC Mesh Routers Firmware Version 016 2020 devices improperly manage sessions, which allows remote attackers to bypass authentication in opportunistic circumstances and execute arbitrary commands with administrator privileges by leveraging an existing web portal login.
Product
Wmb250ac Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 22, 2023Aztech WMB250AC Mesh Routers Firmware Version 016 2020 is vulnerable to PHP Type Juggling in file /var/www/login.php, allows attackers to gain escalated privileCVE-2022-45599 · Other software · Aztech · reported by MITRECritical 9.8
Aztech WMB250AC Mesh Routers Firmware Version 016 2020 is vulnerable to PHP Type Juggling in file /var/www/login.php, allows attackers to gain escalated privileges only when specific conditions regarding a given accounts hashed password.
Product
Wmb250ac Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 13, 2023NETGEAR Nighthawk WiFi Mesh systems and routers are affected by a stack-based buffer overflow vulnerability.CVE-2022-48322 · Network & remote access · Netgear · reported by MITRECritical 9.8
NETGEAR Nighthawk WiFi Mesh systems and routers are affected by a stack-based buffer overflow vulnerability. This affects MR60 before 1.1.7.132, MS60 before 1.1.7.132, R6900P before 1.3.3.154, R7000P before 1.3.3.154, R7960P before 1.4.4.94, and R8000P before 1.4.4.94.
Product
Mr60 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.netgear.com kb.netgear.com
Feb 3, 2023A command injection vulnerability in the serverIp parameter in the function meshSlaveUpdate of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commanCVE-2023-24152 · Other software · Totolink · reported by MITRECritical 9.8
A command injection vulnerability in the serverIp parameter in the function meshSlaveUpdate of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
Product
T8 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 3, 2023A command injection vulnerability in the serverIp parameter in the function meshSlaveDlfw of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commandsCVE-2023-24150 · Other software · Totolink · reported by MITRECritical 9.8
A command injection vulnerability in the serverIp parameter in the function meshSlaveDlfw of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
Product
T8 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 1, 2023Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA0107_05.01.00-BX8-AMESH-08 is affected by: Buffer Overflow.CVE-2022-31364 · Other software · Infineon · reported by MITREHigh 8.2
Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA0107_05.01.00-BX8-AMESH-08 is affected by: Buffer Overflow. The impact is: execute arbitrary code (remote). The component is: affected function is lower_transport_layer_on_seg. ¶¶ In Cypress Bluetooth Mesh SDK, there is an out-of-bound write vulnerability that can be triggered by sending a series of segmented packets with inconsistent SegN.
Product
Cypress Bluetooth Mesh Software Development KIT
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.google.com docs.google.com
Feb 1, 2023Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA0107_05.01.00-BX8-AMESH-08 is affected by: Buffer Overflow.CVE-2022-31363 · Other software · Infineon · reported by MITREHigh 8.2
Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA0107_05.01.00-BX8-AMESH-08 is affected by: Buffer Overflow. The impact is: execute arbitrary code (remote). The component is: affected function is pb_transport_handle_frag_. ¶¶ In Cypress Bluetooth Mesh SDK, there is an out-of-bound write vulnerability that can be triggered during mesh provisioning. Because there is no check for mismatched SegN and TotalLength in Transaction Start PDU.
Product
Cypress Bluetooth Mesh Software Development KIT
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.google.com docs.google.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.