Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
552 results · page 6 of 12
Aug 1, 2023Use after free in Diagnostics in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed an attacker who convinced a user to install a malicious extension to CVE-2023-3731 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in Diagnostics in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Jul 18, 2023Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Diagnostics).CVE-2023-22042 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.3-12.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data as well as unauthorized read access to a subset of Oracle Applications Framework accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
- Product
- Applications Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2023Open Enclave is a hardware-agnostic open source library for developing applications that utilize Hardware-based Trusted Execution Environments, also known as EnCVE-2023-37479 · Other software · openenclave · reported by GitHubMedium 5.3
Open Enclave is a hardware-agnostic open source library for developing applications that utilize Hardware-based Trusted Execution Environments, also known as Enclaves. There are two issues that are mitigated in version 0.19.3. First, Open Enclave SDK does not properly sanitize the `MXCSR` register on enclave entry. This makes applications vulnerable to MXCSR Configuration Dependent Timing (MCDT) attacks, where incorrect `MXCSR` values can impact instruction retirement by at most one cycle, depending on the (secret) data operand value. Please find more details in the guidance from Intel in the references. Second, Open Enclave SDK does not sanitize x86's alignment check flag `RFLAGS.AC` on enclave entry. This opens up the possibility for a side-channel attacker to be notified for every unaligned memory access performed by the enclave. The issue has been addressed in version 0.19.3 and the current master branch. Users will need to recompile their applications against the patched libraries to be protected from this vulnerability. There are no known workarounds for this vulnerability.
- Product
- openenclave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023SAP Solution Manager (Diagnostics agent) - version 7.20, allows an unauthenticated attacker to blindly execute HTTP requests.CVE-2023-36925 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.2
SAP Solution Manager (Diagnostics agent) - version 7.20, allows an unauthenticated attacker to blindly execute HTTP requests. On successful exploitation, the attacker can cause a limited impact on confidentiality and availability of the application and other applications the Diagnostics Agent can reach.
- Product
- SAP Solution Manager (Diagnostics agent)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023SAP Solution Manager (Diagnostics agent) - version 7.20, allows an attacker to tamper with headers in a client request.CVE-2023-36921 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.2
SAP Solution Manager (Diagnostics agent) - version 7.20, allows an attacker to tamper with headers in a client request. This misleads SAP Diagnostics Agent to serve poisoned content to the server. On successful exploitation, the attacker can cause a limited impact on confidentiality and availability of the application.
- Product
- SAP Solution Manager (Diagnostic Agent)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2023TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function.CVE-2023-37172 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function.
- Product
- a3000ru
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2023Frauscher Sensortechnik GmbH FDS001 for FAdC/FAdCi v1.3.3 and all previous versions are vulnerable to a path traversal vulnerability of the web interface by a cCVE-2023-2880 · Other software · Frauscher Sensortechnik · reported by info@cert.vde.comHigh 7.5
Frauscher Sensortechnik GmbH FDS001 for FAdC/FAdCi v1.3.3 and all previous versions are vulnerable to a path traversal vulnerability of the web interface by a crafted URL without authentication. This enables an remote attacker to read all files on the filesystem of the FDS001 device.
- Product
- Diagnostic System FDS101 for FAdC/FAdCi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Jun 29, 2023Maxprint Maxlink 1200G v3.4.11E has an OS command injection vulnerability in the "Diagnostic tool" functionality of the device.CVE-2023-36143 · Other software · maxprintisp · reported by MITREHigh 8.8
Maxprint Maxlink 1200G v3.4.11E has an OS command injection vulnerability in the "Diagnostic tool" functionality of the device.
- Product
- maxlink_1200g
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2023Certain versions of HP PC Hardware Diagnostics Windows are potentially vulnerable to buffer overflow.CVE-2023-32674 · Other software · HP Inc. · reported by hp-security-alert@hp.comCritical 9.8
Certain versions of HP PC Hardware Diagnostics Windows are potentially vulnerable to buffer overflow.
- Product
- HP PC Hardware Diagnostics Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Jun 12, 2023Certain versions of HP PC Hardware Diagnostics Windows, HP Image Assistant, and HP Thunderbolt Dock G2 Firmware are potentially vulnerable to elevation of priviCVE-2023-32673 · Other software · HP Inc. · reported by hp-security-alert@hp.comCritical 9.8
Certain versions of HP PC Hardware Diagnostics Windows, HP Image Assistant, and HP Thunderbolt Dock G2 Firmware are potentially vulnerable to elevation of privilege.
- Product
- HP PC Hardware Diagnostics Windows, HP Image Assistant, and HP Thunderbolt Dock G2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Jun 9, 2023MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings.CVE-2023-0342 · Other software · MongoDB Inc. · reported by cna@mongodb.comLow 3.1
MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12
- Product
- MongoDB Ops Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmongodb.commongodb.com
Jun 6, 2023D-Link DIR-842V2 v1.0.3 was discovered to contain a command injection vulnerability via the iperf3 diagnostics function.CVE-2023-33782 · Other software · Dlink · reported by MITREHigh 8.8
D-Link DIR-842V2 v1.0.3 was discovered to contain a command injection vulnerability via the iperf3 diagnostics function.
- Product
- Dir-842v2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2023 Controller 6000 is vulnerable to a buffer overflow via the Controller diagnostic web interface upload feature.CVE-2023-24584 · Other software · Gallagher · reported by disclosures@gallagher.comHigh 7.5
Controller 6000 is vulnerable to a buffer overflow via the Controller diagnostic web interface upload feature. This issue affects Controller 6000: before vCR8.80.230201a, before vCR8.70.230201a, before vCR8.60.230201b, before vCR8.50.230201a, all versions of vCR8.40 and prior.
- Product
- Controller 6000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gallagher.comsecurity.gallagher.com
May 31, 2023Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityCVE-2022-35743 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
May 31, 2023TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a command insertion vulnerability in setDiagnosisCfg.This vulnerability allows an attCVE-2023-33487 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a command insertion vulnerability in setDiagnosisCfg.This vulnerability allows an attacker to execute arbitrary commands through the "ip" parameter.
- Product
- X5000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2023Heap-based overflow in Intel(R) SoC Watch based software before version 2021.1 may allow a privileged user to potentially enable escalation of privilege via locCVE-2023-30763 · Other software · Intel · reported by secure@intel.comHigh 7.2
Heap-based overflow in Intel(R) SoC Watch based software before version 2021.1 may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Battery Life Diagnostic Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2023Linksys AX3200 1.1.00 is vulnerable to OS command injection by authenticated users via shell metacharacters to the diagnostics traceroute page.CVE-2022-38841 · Network & remote access · Linksys · reported by MITREHigh 8.8
Linksys AX3200 1.1.00 is vulnerable to OS command injection by authenticated users via shell metacharacters to the diagnostics traceroute page.
- Product
- E8450 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comdrive.google.com
Apr 14, 2023TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function.CVE-2023-29802 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function.
- Product
- X18 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsore-pail-31b.notion.sitesore-pail-31b.notion.site
Apr 10, 2023Due to missing authentication and input sanitization of code the EventLogServiceCollector of SAP Diagnostics Agent - version 720, allows an attacker to execute CVE-2023-27497 · Network & remote access · SAP · reported by cna@sap.comCritical 10
Due to missing authentication and input sanitization of code the EventLogServiceCollector of SAP Diagnostics Agent - version 720, allows an attacker to execute malicious scripts on all connected Diagnostics Agents running on Windows. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.
- Product
- Diagnostics Agent (EventLogServiceCollector)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Apr 10, 2023Due to missing authentication and insufficient input validation, the OSCommand Bridge of SAP Diagnostics Agent - version 720, allows an attacker with deep knowlCVE-2023-27267 · Network & remote access · SAP · reported by cna@sap.comCritical 9
Due to missing authentication and insufficient input validation, the OSCommand Bridge of SAP Diagnostics Agent - version 720, allows an attacker with deep knowledge of the system to execute scripts on all connected Diagnostics Agents. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.
- Product
- Diagnostics Agent (OSCommand Bridge)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Mar 3, 2023An issue discovered in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to escalate privileges via WGET command to the Network DiagnoCVE-2022-45551 · Other software · ZBT · reported by MITRECritical 9.8
An issue discovered in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to escalate privileges via WGET command to the Network Diagnosis endpoint.
- Product
- We1626 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.prodefense.ioblog.prodefense.io
Feb 16, 2023Uncontrolled search path in the Intel(R) Battery Life Diagnostic Tool software before version 2.2.0 may allow an authenticated user to potentially enable escalaCVE-2022-36398 · Other software · Intel · reported by secure@intel.comMedium 6.7
Uncontrolled search path in the Intel(R) Battery Life Diagnostic Tool software before version 2.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Battery Life Diagnostic Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Insufficient control flow management in the Intel(R) Battery Life Diagnostic Tool software before version 2.2.0 may allow an authenticated user to potentially eCVE-2022-36278 · Other software · Intel · reported by secure@intel.comHigh 8.2
Insufficient control flow management in the Intel(R) Battery Life Diagnostic Tool software before version 2.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Battery Life Diagnostic Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Improper initialization in the Intel(R) Battery Life Diagnostic Tool software before version 2.2.0 may allow an authenticated user to potentially enable escalatCVE-2022-34153 · Other software · Intel · reported by secure@intel.comHigh 8.2
Improper initialization in the Intel(R) Battery Life Diagnostic Tool software before version 2.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Battery Life Diagnostic Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2023 A reflected cross-site scripting (XSS) vulnerability exists in System Diagnostics Manager of B&R Automation Runtime versions >=3.00 and <=C4.93 that enables a CVE-2022-4286 · Other software · B&R Industrial Automation · reported by cybersecurity@ch.abb.comMedium 6.1
A reflected cross-site scripting (XSS) vulnerability exists in System Diagnostics Manager of B&R Automation Runtime versions >=3.00 and <=C4.93 that enables a remote attacker to execute arbitrary JavaScript in the context of the users browser session.
- Product
- B&R Automation Runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbr-automation.combr-automation.com
Feb 11, 2023IBM MQ 8.0.0, 9.0.0, 9.1.0, 9.2.0, 9.3.0 Managed File Transfer could allow a local user to obtain sensitive information from diagnostic files.CVE-2022-42436 · Other software · IBM · reported by psirt@us.ibm.comMedium 4
IBM MQ 8.0.0, 9.0.0, 9.1.0, 9.2.0, 9.3.0 Managed File Transfer could allow a local user to obtain sensitive information from diagnostic files. IBM X-Force ID: 238206.
- Product
- MQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 20, 2023Directory traversal vulnerability in Reprise License Manager (RLM) web interface before 14.2BL4 in the diagnostics function that allows RLM users with sufficienCVE-2021-37500 · Other software · Reprisesoftware · reported by MITREHigh 8.1
Directory traversal vulnerability in Reprise License Manager (RLM) web interface before 14.2BL4 in the diagnostics function that allows RLM users with sufficient privileges to overwrite any file the on the server.
- Product
- Reprise License Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2023The webserver in Delta DX-3021 versions prior to 1.24 is vulnerable to command injection through the network diagnosis page.CVE-2022-4616 · Other software · Delta Industrial Automation · reported by ics-cert@hq.dhs.govHigh 7.2
The webserver in Delta DX-3021 versions prior to 1.24 is vulnerable to command injection through the network diagnosis page. This vulnerability could allow a remote unauthenticated user to add files, delete files, and change file permissions.
- Product
- 4G Router DX-3021
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownloadcenter.deltaww.comcisa.gov
Dec 30, 2022Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request.CVE-2022-44621 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request.
- Product
- Apache Kylin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Dec 13, 2022Delta Electronics DX-2100-L1-CN 2.42 is vulnerable to Command Injection via lform/net_diagnose.CVE-2022-42140 · Other software · Deltaww · reported by MITREHigh 7.2
Delta Electronics DX-2100-L1-CN 2.42 is vulnerable to Command Injection via lform/net_diagnose.
- Product
- Dx-2100-l1-cn Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyberdanube.comcyberdanube.com
Dec 12, 2022SAP Solution Manager (Diagnostic Agent) - version 7.20, allows an authenticated attacker on Windows system to access a file containing sensitive data which can CVE-2022-41261 · Network & remote access · SAP · reported by cna@sap.comMedium 6
SAP Solution Manager (Diagnostic Agent) - version 7.20, allows an authenticated attacker on Windows system to access a file containing sensitive data which can be used to access a configuration file which contains credentials to access other system files. Successful exploitation can make the attacker access files and systems for which he/she is not authorized.
- Product
- Solution Manager (Diagnostic Agent)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Dec 12, 2022HP Support Assistant uses HP Performance Tune-up as a diagnostic tool.CVE-2022-38395 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 7.8
HP Support Assistant uses HP Performance Tune-up as a diagnostic tool. HP Support Assistant uses Fusion to launch HP Performance Tune-up. It is possible for an attacker to exploit the DLL hijacking vulnerability and elevate privileges when Fusion launches the HP Performance Tune-up.
- Product
- HP Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Dec 2, 2022Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/setDiagnoseInfo.CVE-2022-44366 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/setDiagnoseInfo.
- Product
- I21 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2022TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter ip in the setDiagnosisCfg function.CVE-2022-44253 · Other software · Totolink · reported by MITREHigh 8.8
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter ip in the setDiagnosisCfg function.
- Product
- Lr350 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbrief-nymphea-813.notion.sitebrief-nymphea-813.notion.site
Nov 17, 2022Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /clients/view_client.php.CVE-2022-43163 · Other software · Online Diagnostic Lab Management System Project · reported by MITREHigh 7.2
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /clients/view_client.php.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2022Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tests/view_test.php.CVE-2022-43162 · Other software · Online Diagnostic Lab Management System Project · reported by MITREHigh 7.2
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tests/view_test.php.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2022Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at /diagnostic/login.php.CVE-2022-43135 · Other software · Online Diagnostic Lab Management System Project · reported by MITRECritical 9.8
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at /diagnostic/login.php.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms//classes/Master.php?f=deleteCVE-2022-43058 · Other software · Online Diagnostic Lab Management System Project · reported by MITRECritical 9.8
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms//classes/Master.php?f=delete_activity.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022In WAGO I/O-Check Service in multiple products an attacker can send a specially crafted packet containing OS commands to crash the diagnostic tool and write memCVE-2021-34569 · Other software · WAGO · reported by info@cert.vde.comCritical 9.8
In WAGO I/O-Check Service in multiple products an attacker can send a specially crafted packet containing OS commands to crash the diagnostic tool and write memory.
- Product
- 750-81xx/xxx-xxxFW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Nov 7, 2022Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Users.php?f=delete.CVE-2022-43052 · Other software · Online Diagnostic Lab Management System Project · reported by MITREHigh 7.2
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Users.php?f=delete.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2022Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Users.php?f=delete_tCVE-2022-43051 · Other software · Online Diagnostic Lab Management System Project · reported by MITREHigh 7.2
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Users.php?f=delete_test.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2022Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Users.php?f=delete_client.CVE-2022-43063 · Other software · Online Diagnostic Lab Management System Project · reported by MITREHigh 7.2
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Users.php?f=delete_client.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2022Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_appoinCVE-2022-43062 · Other software · Online Diagnostic Lab Management System Project · reported by MITREHigh 7.2
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_appointment.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2022Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_reservCVE-2022-43068 · Other software · Online Diagnostic Lab Management System Project · reported by MITREHigh 7.2
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_reservation.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2022Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Master.php?f=delete_CVE-2022-43066 · Other software · Online Diagnostic Lab Management System Project · reported by MITREHigh 7.2
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Master.php?f=delete_message.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2022Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/admin/?page=appointments/vieCVE-2022-43227 · Other software · Online Diagnostic Lab Management System Project · reported by MITREHigh 7.2
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/admin/?page=appointments/view_appointment.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2022Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/?page=appointments/view_appoCVE-2022-43226 · Other software · Online Diagnostic Lab Management System Project · reported by MITREHigh 8.8
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/?page=appointments/view_appointment.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2022Frauscher Sensortechnik GmbH FDS102 for FAdC R2 and FAdCi R2 v2.8.0 to v2.9.1 are vulnerable to malicious code upload without authentication by using the configCVE-2022-3575 · Other software · Frauscher Sensortechnik · reported by info@cert.vde.comCritical 9.8
Frauscher Sensortechnik GmbH FDS102 for FAdC R2 and FAdCi R2 v2.8.0 to v2.9.1 are vulnerable to malicious code upload without authentication by using the configuration upload function. This could lead to a complete compromise of the FDS102 device.
- Product
- Diagnostic System FDS102
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfrauscher.comfrauscher.com
Nov 1, 2022Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /appointments/update_status.php.CVE-2022-43127 · Other software · Online Diagnostic Lab Management System Project · reported by MITREHigh 7.2
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /appointments/update_status.php.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/tests/manage_test.php.CVE-2022-43126 · Other software · Online Diagnostic Lab Management System Project · reported by MITREHigh 7.2
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/tests/manage_test.php.
- Product
- Online Diagnostic Lab Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.