Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
657 results · page 6 of 14
Oct 11, 2022The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-41383 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.
- Product
- D8s-archives
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022The d8s-json package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-41382 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-json package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.
- Product
- D8s-json
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-41381 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.
- Product
- D8s-utility
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022The d8s-yaml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-41380 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-yaml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.
- Product
- D8s-yaml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022Windows Distributed File System (DFS) Information Disclosure VulnerabilityCVE-2022-38025 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Windows Distributed File System (DFS) Information Disclosure Vulnerability
- Product
- Windows Server 2022
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Sep 19, 2022The d8s-pdfs for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40812 · Other software · Democritus Pdfs Project · reported by MITRECritical 9.8
The d8s-pdfs for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.
- Product
- Democritus Pdfs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40810 · Other software · Democritus IP Addresses Project · reported by MITRECritical 9.8
The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0
- Product
- Democritus IP Addresses
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-dicts for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40809 · Other software · Democritus Dicts Project · reported by MITRECritical 9.8
The d8s-dicts for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0
- Product
- Democritus Dicts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40432 · Other software · D8s-strings Project · reported by MITRECritical 9.8
The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0.
- Product
- D8s-strings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-pdfs for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40431 · Other software · D8s-pdfs Project · reported by MITRECritical 9.8
The d8s-pdfs for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0.
- Product
- D8s-pdfs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-utility for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40430 · Other software · D8s-utility Project · reported by MITRECritical 9.8
The d8s-utility for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0.
- Product
- D8s-utility
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40429 · Other software · D8s-ip-addresses Project · reported by MITRECritical 9.8
The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0.
- Product
- D8s-ip-addresses
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-mpeg for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40428 · Other software · D8s-mpeg Project · reported by MITRECritical 9.8
The d8s-mpeg for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0.
- Product
- D8s Mpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-asns for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40426 · Other software · D8s-asns Project · reported by MITRECritical 9.8
The d8s-asns for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0.
- Product
- D8s-asns
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-html for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40425 · Other software · D8s-html Project · reported by MITRECritical 9.8
The d8s-html for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0.
- Product
- D8s-html
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-38887 · Other software · D8s-python Project · reported by MITRECritical 9.8
The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The democritus-strings package. The affected version is 0.1.0.
- Product
- D8s-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-38886 · Other software · D8s-xml Project · reported by MITRECritical 9.8
The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0.
- Product
- D8s-xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-netstrings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-38885 · Other software · D8s-netstrings Project · reported by MITRECritical 9.8
The d8s-netstrings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0.
- Product
- D8s-netstrings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-grammars for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-38884 · Other software · D8s-grammars Project · reported by MITRECritical 9.8
The d8s-grammars for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0.
- Product
- D8s-grammars
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-38883 · Other software · D8s-math Project · reported by MITRECritical 9.8
The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0.
- Product
- D8s-math
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-json for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-38882 · Other software · D8s-json Project · reported by MITRECritical 9.8
The d8s-json for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0.
- Product
- D8s-json
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-archives for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-38881 · Other software · D8s-archives Project · reported by MITRECritical 9.8
The d8s-archives for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0.
- Product
- D8s-archives
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40811 · Other software · Democritus Urls Project · reported by MITRECritical 9.8
The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.
- Product
- Democritus Urls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40808 · Other software · Democritus Dates Project · reported by MITRECritical 9.8
The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0
- Product
- Democritus Dates
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-domains for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40807 · Other software · Democritus Domains Project · reported by MITRECritical 9.8
The d8s-domains for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0
- Product
- Democritus Domains
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-uuids for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40806 · Other software · Democritus Uuids Project · reported by MITRECritical 9.8
The d8s-uuids for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0
- Product
- Democritus Uuids
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-urls for python 0.1.0, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40805 · Other software · Democritus Urls Project · reported by MITRECritical 9.8
The d8s-urls for python 0.1.0, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-hypothesis package.
- Product
- Democritus Urls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-domains for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40427 · Other software · Democritus Domains Project · reported by MITRECritical 9.8
The d8s-domains for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0
- Product
- Democritus Domains
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-40424 · Other software · Democritus Urls Project · reported by MITRECritical 9.8
The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-networking package. The affected version of d8s-urls is 0.1.0
- Product
- Democritus Urls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-38880 · Other software · Democritus Urls Project · reported by MITRECritical 9.8
The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The affected version is 0.1.0.
- Product
- Democritus Urls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022Windows Distributed File System (DFS) Elevation of Privilege VulnerabilityCVE-2022-34719 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Distributed File System (DFS) Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 9, 2022indy-node is the server portion of Hyperledger Indy, a distributed ledger purpose-built for decentralized identity.CVE-2022-31006 · Other software · hyperledger · reported by GitHubHigh 7.5
indy-node is the server portion of Hyperledger Indy, a distributed ledger purpose-built for decentralized identity. In vulnerable versions of indy-node, an attacker can max out the number of client connections allowed by the ledger, leaving the ledger unable to be used for its intended purpose. However, the ledger content will not be impacted and the ledger will resume functioning after the attack. This attack exploits the trade-off between resilience and availability. Any protection against abusive client connections will also prevent the network being accessed by certain legitimate users. As a result, validator nodes must tune their firewall rules to ensure the right trade-off for their network's expected users. The guidance to network operators for the use of firewall rules in the deployment of Indy networks has been modified to better protect against denial of service attacks by increasing the cost and complexity in mounting such attacks. The mitigation for this vulnerability is not in the Hyperledger Indy code per se, but rather in the individual deployments of Indy. The mitigations should be applied to all deployments of Indy, and are not related to a particular release.
- Product
- indy-node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2022Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity.CVE-2022-31020 · Other software · hyperledger · reported by GitHubHigh 8.8
Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the `pool-upgrade` request handler in Indy-Node allows an improperly authenticated attacker to remotely execute code on nodes within the network. The `pool-upgrade` request handler in Indy-Node 1.12.5 has been updated to properly authenticate pool-upgrade transactions before any processing is performed by the request handler. The transactions are further sanitized to prevent remote code execution. As a workaround, endorsers should not create DIDs for untrusted users. A vulnerable ledger should configure `auth_rules` to prevent new DIDs from being written to the ledger until the network can be upgraded.
- Product
- indy-node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications.CVE-2022-36023 · Other software · hyperledger · reported by GitHubHigh 7
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. If a gateway client application sends a malformed request to a gateway peer it may crash the peer node. Version 2.4.6 checks for the malformed gateway request and returns an error to the gateway client. There are no known workarounds, users must upgrade to version 2.4.6.
- Product
- fabric
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2022The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords.CVE-2022-29965 · Other software · Emerson · reported by MITREMedium 5.5
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged operations on the maintenance port TELNET interface (23/TCP) on M-series and SIS (CSLS/LSNB/LSNG) nodes is controlled by means of utility passwords. These passwords are generated using a deterministic, insecure algorithm using a single seed value composed of a day/hour/minute timestamp with less than 16 bits of entropy. The seed value is fed through a lookup table and a series of permutation operations resulting in three different four-character passwords corresponding to different privilege levels. An attacker can easily reconstruct these passwords and thus gain access to privileged maintenance operations. NOTE: this is different from CVE-2014-2350.
- Product
- Deltav Distributed Control System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2022The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords.CVE-2022-29964 · Other software · Emerson · reported by MITREMedium 5.5
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. WIOC SSH provides access to a shell as root, DeltaV, or backup via hardcoded credentials. NOTE: this is different from CVE-2014-2350.
- Product
- Deltav Distributed Control System SQ Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2022The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords.CVE-2022-29963 · Other software · Emerson · reported by MITREMedium 5.5
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. TELNET on port 18550 provides access to a root shell via hardcoded credentials. This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350.
- Product
- Deltav Distributed Control System SQ Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2022The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords.CVE-2022-29962 · Other software · Emerson · reported by MITREMedium 5.5
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often be disabled in production). This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350.
- Product
- Deltav Distributed Control System SQ Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2022The Emerson DeltaV Distributed Control System (DCS) through 2022-04-29 mishandles authentication.CVE-2022-29957 · Other software · Emerson · reported by MITREHigh 7.8
The Emerson DeltaV Distributed Control System (DCS) through 2022-04-29 mishandles authentication. It utilizes several proprietary protocols for a wide variety of functionality. These protocols include Firmware upgrade (18508/TCP, 18518/TCP); Plug-and-Play (18510/UDP); Hawk services (18507/UDP); Management (18519/TCP); Cold restart (18512/UDP); SIS communications (12345/TCP); and Wireless Gateway Protocol (18515/UDP). None of these protocols have any authentication features, allowing any attacker capable of communicating with the ports in question to invoke (a subset of) desired functionality.
- Product
- Deltav Distributed Control System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022Git is a distributed revision control system.CVE-2022-29187 · Other software · git · reported by GitHubHigh 7.8
Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An unsuspecting user could still be affected by the issue reported in CVE-2022-24765, for example when navigating as root into a shared tmp directory that is owned by them, but where an attacker could create a git repository. Versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5 contain a patch for this issue. The simplest way to avoid being affected by the exploit described in the example is to avoid running git as root (or an Administrator in Windows), and if needed to reduce its use to a minimum. While a generic workaround is not possible, a system could be hardened from the exploit described in the example by removing any such repository if it exists already and creating one as root to block any future attacks.
- Product
- git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgopenwall.com
Jul 7, 2022Hyperledger Fabric is a permissioned distributed ledger framework.CVE-2022-31121 · Other software · hyperledger · reported by GitHubHigh 7.5
Hyperledger Fabric is a permissioned distributed ledger framework. In affected versions if a consensus client sends a malformed consensus request to an orderer it may crash the orderer node. A fix has been added in commit 0f1835949 which checks for missing consensus messages and returns an error to the consensus client should the message be missing. Users are advised to upgrade to versions 2.2.7 or v2.4.5. There are no known workarounds for this issue.
- Product
- fabric
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 can store a script that could impact other logged in users.CVE-2022-2254 · Other software · Distributed Data Systems · reported by ics-cert@hq.dhs.govMedium 6.2
A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 can store a script that could impact other logged in users.
- Product
- WebHMI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 may send OS commands to execute on the host server.CVE-2022-2253 · Other software · Distributed Data Systems · reported by ics-cert@hq.dhs.govCritical 9.1
A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 may send OS commands to execute on the host server.
- Product
- WebHMI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022A remote disclosure of sensitive information vulnerability was discovered in HPE NonStop DSM/SCM version: T6031H03^ADP.CVE-2022-28621 · Other software · HPE · reported by security-alert@hpe.comHigh 7.5
A remote disclosure of sensitive information vulnerability was discovered in HPE NonStop DSM/SCM version: T6031H03^ADP. HPE has provided a software update to resolve this vulnerability in HPE NonStop DSM/SCM.
- Product
- Nonstop Distributed Systems Management / Software Configuration Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Jun 24, 2022The pyesasky for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party.CVE-2022-30885 · Other software · ESA · reported by MITRECritical 9.8
The pyesasky for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.2.0-1.4.2.
- Product
- Pyesasky
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpypi.doubanio.comgithub.com
Jun 8, 2022The keep for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party.CVE-2022-30877 · Other software · Keep Project · reported by MITRECritical 9.8
The keep for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.2.
- Product
- Keep
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpypi.doubanio.comgithub.com
May 6, 2022The Monitoring Console app configured in Distributed mode allows for a Reflected XSS in a query parameter in Splunk Enterprise versions before 8.1.4.CVE-2022-27183 · Other software · Splunk · reported by prodsec@splunk.comHigh 8.8
The Monitoring Console app configured in Distributed mode allows for a Reflected XSS in a query parameter in Splunk Enterprise versions before 8.1.4. The Monitoring Console app is a bundled app included in Splunk Enterprise, not for download on SplunkBase, and not installed on Splunk Cloud Platform instances. Note that the Cloud Monitoring Console is not impacted.
- Product
- Splunk Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.splunk.comsplunk.com
Apr 4, 2022There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to read files in arbitrary CVE-2021-44138 · Other software · Caucho · reported by MITREHigh 7.5
There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to read files in arbitrary directories via a ; in a pathname within an HTTP request.
- Product
- Resin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2022Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege escalation on the DeltaV Distributed Control System Controllers and CVE-2021-44463 · Other software · Emerson · reported by ics-cert@hq.dhs.govHigh 8.1
Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege escalation on the DeltaV Distributed Control System Controllers and Workstations (All versions) when some DeltaV services are started.
- Product
- Deltav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2022A specially crafted script could cause the DeltaV Distributed Control System Controllers (All Versions) to restart and cause a denial-of-service condition.CVE-2021-26264 · Other software · Emerson · reported by ics-cert@hq.dhs.govMedium 6.1
A specially crafted script could cause the DeltaV Distributed Control System Controllers (All Versions) to restart and cause a denial-of-service condition.
- Product
- Deltav Workstation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.