Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
388 results · page 6 of 8
Dec 7, 2023An issue in SCOL Members Card mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.CVE-2023-43298 · Other software · Linecorp · reported by MITREMedium 5.3
An issue in SCOL Members Card mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2023Web Push Notifications: Does not prevent visitors on the site from changing some of the plugin optionsCVE-2023-5620 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Web Push Notifications WordPress plugin before 4.35.0 does not prevent visitors on the site from changing some of the plugin options, some of which may be used to conduct Stored XSS attacks.
- Product
- Web Push Notifications
- Fixed in
- 4.35.0
- What to do
- Update Web Push Notifications to 4.35.0 or newer.
Nov 13, 2023An issue in Yasukawa memberscard v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.CVE-2023-45560 · Other software · Memberscard Project · reported by MITREHigh 7.5
An issue in Yasukawa memberscard v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.
- Product
- Memberscard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2023An issue in Golden v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.CVE-2023-45558 · Other software · golden_project · reported by MITREHigh 7.5
An issue in Golden v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.
- Product
- golden
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability leading to Local File Inclusion (LF) in Webpushr Web Push Notifications Web Push Notifications – Webpushr pluginCVE-2023-35041 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability leading to Local File Inclusion (LF) in Webpushr Web Push Notifications Web Push Notifications – Webpushr plugin <= 4.34.0 versions.
- Affected
- up to 4.34.0
- What to do
- Affects up to 4.34.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 9, 2023The leakage of channel access token in DRAGON FAMILY Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47373 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in DRAGON FAMILY Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in UPDATESALON C-LOUNGE Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47372 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in UPDATESALON C-LOUNGE Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in bluetrick Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47370 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in bluetrick Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in taketorinoyu Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47368 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in taketorinoyu Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in best_training_member Line 13.6.1 allows remote attackers to send malicious notifications.CVE-2023-47369 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in best_training_member Line 13.6.1 allows remote attackers to send malicious notifications.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in platinum clinic Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47367 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in platinum clinic Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in craft_members Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47366 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in craft_members Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in Lil.OFF-PRICE STORE Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47365 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in Lil.OFF-PRICE STORE Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in nagaoka taxi Line 13.6.1 allows remote attackers to send malicious notifications to victimsCVE-2023-47364 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in nagaoka taxi Line 13.6.1 allows remote attackers to send malicious notifications to victims
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023The leakage of channel access token in F.B.P members Line 13.6.1 allows remote attackers to send malicious notifications to victims.CVE-2023-47363 · Other software · Linecorp · reported by MITREMedium 6.5
The leakage of channel access token in F.B.P members Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to send notifications to computCVE-2023-43509 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 5.8
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to send notifications to computers that are running ClearPass OnGuard. These notifications can then be used to phish users or trick them into downloading malicious software.
- Product
- Aruba ClearPass Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Oct 17, 2023Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Events & Notifications).CVE-2023-22090 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Events & Notifications). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CC Common Application Objects accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
- Product
- PeopleSoft Enterprise CC Common Application Objects
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2023The Bluetooth module has a vulnerability in permission control for broadcast notifications.Successful exploitation of this vulnerability may affect confidentialCVE-2023-44101 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The Bluetooth module has a vulnerability in permission control for broadcast notifications.Successful exploitation of this vulnerability may affect confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2023An issue in animal-art-lab v13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.CVE-2023-43297 · Other software · Linecorp · reported by MITREMedium 5.4
An issue in animal-art-lab v13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.
- Product
- Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2023Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information.CVE-2023-4580 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Aug 1, 2023Inappropriate implementation in Notifications in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to spoof the contents of media notifications viaCVE-2023-3737 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Inappropriate implementation in Notifications in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to spoof the contents of media notifications via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Aug 1, 2023A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions.CVE-2023-4047 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orglists.debian.org
Jul 31, 2023A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers to inject execute aCVE-2023-35861 · Other software · supermicro · reported by MITRECritical 9.8
A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers to inject execute arbitrary commands as root on the BMC.
- Product
- h12dst-b
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.freax13.desupermicro.com
Jul 28, 2023Incorrect security UI in Notifications in Google Chrome on Android prior to 103.0.5060.53 allowed a remote attacker to obscure the full screen notification via CVE-2022-4917 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Incorrect security UI in Notifications in Google Chrome on Android prior to 103.0.5060.53 allowed a remote attacker to obscure the full screen notification via a crafted HTML page. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Jul 28, 2023An issue in the delete function in the OaNotifyController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete notifications created by CVE-2023-38988 · Other software · Jeesite · reported by MITREMedium 4.3
An issue in the delete function in the OaNotifyController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete notifications created by Administrators.
- Product
- Jeesite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in Prem Tiwari Disable WordPress Update Notifications and auto-update Email Notifications plugin <= 2.3.3 versioCVE-2023-34029 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Prem Tiwari Disable WordPress Update Notifications and auto-update Email Notifications plugin <= 2.3.3 versions.
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 6, 2023Novu provides an API for sending notifications through multiple channels.CVE-2023-35948 · Other software · novuhq · reported by GitHubMedium 5.4
Novu provides an API for sending notifications through multiple channels. Versions prior to 0.16.0 contain an open redirect vulnerability in the "Sign In with GitHub" functionality of Novu's open-source repository. It could have allowed an attacker to force a victim into opening a malicious URL and thus, potentially log into the repository under the victim's account gaining full control of the account. This vulnerability only affected the Novu Cloud and Open-Source deployments if the user manually enabled the GitHub OAuth on their self-hosted instance of Novu. Users should upgrade to version 0.16.0 to receive a patch.
- Product
- novu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2023Improper Knox ID validation logic in notification framework prior to SMR Jun-2023 Release 1 allows local attackers to read work profile notifications without prCVE-2023-21512 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 2.4
Improper Knox ID validation logic in notification framework prior to SMR Jun-2023 Release 1 allows local attackers to read work profile notifications without proper access permission.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jun 16, 2023Vulnerability in Cloud Foundry Notifications, Cloud Foundry SMB-volume release, Cloud FOundry cf-nfs-volume release.This issue affects Notifications: All versioCVE-2023-20885 · Other software · Cloud Foundry · reported by security@vmware.comMedium 6.5
Vulnerability in Cloud Foundry Notifications, Cloud Foundry SMB-volume release, Cloud FOundry cf-nfs-volume release.This issue affects Notifications: All versions prior to 63; SMB-volume release: All versions prior to 3.1.19; cf-nfs-volume release: 5.0.X versions prior to 5.0.27, 7.1.X versions prior to 7.1.19.
- Product
- Notifications
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcloudfoundry.orgcloudfoundry.org
Jun 15, 2023In onCreate of NotificationAccessSettings.java, there is a possible failure to persist notifications settings due to improper input validation.CVE-2023-21135 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onCreate of NotificationAccessSettings.java, there is a possible failure to persist notifications settings due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-260570119
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 2, 2023A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions.CVE-2023-32207 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgsecurity.gentoo.org
May 26, 2023Cross-Site Request Forgery (CSRF) vulnerability in Made with Fuel Better Notifications for WP plugin <= 1.9.2 versions.CVE-2023-32964 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Made with Fuel Better Notifications for WP plugin <= 1.9.2 versions.
- Fixed in
- 1.9.3
- What to do
- Update the plugin to 1.9.3 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 15, 2023In several functions of SnoozeHelper.java, there is a possible way to grant notifications access due to resource exhaustion.CVE-2023-21110 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In several functions of SnoozeHelper.java, there is a possible way to grant notifications access due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-258422365
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
May 15, 2023Push Notifications for WordPress by PushAssist: Does not sanitise and escape various parameters before outputting them back in pagesCVE-2023-0644 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Push Notifications for WordPress by PushAssist WordPress plugin through 3.0.8 does not sanitise and escape various parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Push Notifications for WordPress by PushAssist
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Push Notifications for WordPress by PushAssist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 1, 2023An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embeddedCVE-2023-27035 · Other software · Obsidian · reported by MITREMedium 6.5
An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the canvas page.
- Product
- Obsidian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.obsidian.mdforum.obsidian.md
Mar 6, 2023In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risCVE-2021-36403 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 5.3
In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2023Command injection in SMS notifications in Tribe29 Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker with User Management permCVE-2022-46303 · Other software · Tribe29 · reported by security@checkmk.comHigh 8
Command injection in SMS notifications in Tribe29 Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker with User Management permissions, as well as LDAP administrators in certain scenarios, to perform arbitrary commands within the context of the application's local permissions.
- Product
- Checkmk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcheckmk.comcheckmk.com
Feb 20, 2023Octobox is software for managing GitHub notifications.CVE-2021-32848 · Other software · octobox · reported by GitHubHigh 7.5
Octobox is software for managing GitHub notifications. Prior to pull request (PR) 2807, a user of the system can provide a specifically crafted search query string that will trigger a ReDoS vulnerability. This issue is fixed in PR 2807.
- Product
- octobox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023OpenSearch Anomaly Detection identifies atypical data and receives automatic notifications.CVE-2023-23933 · Other software · opensearch-project · reported by GitHubMedium 4.3
OpenSearch Anomaly Detection identifies atypical data and receives automatic notifications. There is an issue with the application of document and field level restrictions in the Anomaly Detection plugin, where users with the Anomaly Detector role can read aggregated numerical data (e.g. averages, sums) of fields that are otherwise restricted to them. This issue only affects authenticated users who were previously granted read access to the indexes containing the restricted fields. This issue has been patched in versions 1.3.8 and 2.6.0. There are no known workarounds for this issue.
- Product
- anomaly-detection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2022In getNearbyNotificationStreamingPolicy of DevicePolicyManagerService.java, there is a possible way to learn about the notification streaming policy of other usCVE-2022-20510 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In getNearbyNotificationStreamingPolicy of DevicePolicyManagerService.java, there is a possible way to learn about the notification streaming policy of other users due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-235822336
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 13, 2022In updatePublicMode of NotificationLockscreenUserManagerImpl.java, there is a possible way to reveal sensitive notifications on the lockscreen due to an incorreCVE-2022-20497 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.6
In updatePublicMode of NotificationLockscreenUserManagerImpl.java, there is a possible way to reveal sensitive notifications on the lockscreen due to an incorrect state transition. This could lead to local information disclosure with physical access required and an app that runs above the lockscreen, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-246301979
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 13, 2022In shouldHideNotification of KeyguardNotificationVisibilityProvider.kt, there is a possible way to show hidden notifications due to a logic error in the code.CVE-2022-20477 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In shouldHideNotification of KeyguardNotificationVisibilityProvider.kt, there is a possible way to show hidden notifications due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-241611867
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 13, 2022In applyKeyguardFlags of NotificationShadeWindowControllerImpl.java, there is a possible way to observe the user's password on a secondary display due to an insCVE-2022-20466 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In applyKeyguardFlags of NotificationShadeWindowControllerImpl.java, there is a possible way to observe the user's password on a secondary display due to an insecure default value. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-179725730
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 5, 2022Workreap: Has a vulnerability with the notifications featureCVE-2022-3846 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Workreap WordPress theme before 2.6.3 has a vulnerability with the notifications feature as it's possible to read any user's notification (employer or freelancer) as the notification ID is brute-forceable.
- Product
- Workreap
- Fixed in
- 2.6.3
- What to do
- Update Workreap to 2.6.3 or newer.
Nov 28, 2022Jeeng Push Notifications: Does not sanitise and escape some of its settingsCVE-2022-3610 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Jeeng Push Notifications WordPress plugin before 2.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Jeeng Push Notifications
- Fixed in
- 2.0.4
- What to do
- Update Jeeng Push Notifications to 2.0.4 or newer.
Nov 11, 2022OpenSearch Notifications is a notifications plugin for OpenSearch that enables other plugins to send notifications via Email, Slack, Amazon Chime, Custom web-hoCVE-2022-41906 · Other software · opensearch-project · reported by GitHubHigh 8.7
OpenSearch Notifications is a notifications plugin for OpenSearch that enables other plugins to send notifications via Email, Slack, Amazon Chime, Custom web-hook etc channels. A potential SSRF issue in OpenSearch Notifications Plugin starting in 2.0.0 and prior to 2.2.1 could allow an existing privileged user to enumerate listening services or interact with configured resources via HTTP requests exceeding the Notification plugin's intended scope. OpenSearch 2.2.1+ contains the fix for this issue. There are currently no recommended workarounds.
- Product
- notifications
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022Use after free in ChromeOS Notifications in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a remote attacker who convinced a user to reboot Chrome OS CVE-2022-3318 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Use after free in ChromeOS Notifications in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a remote attacker who convinced a user to reboot Chrome OS to potentially exploit heap corruption via UI interaction. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Oct 12, 2022A reflected XSS vulnerability exists in REDCap before 12.04.18 in the Alerts & Notifications upload feature.CVE-2022-42715 · Other software · Vanderbilt · reported by MITREMedium 6.1
A reflected XSS vulnerability exists in REDCap before 12.04.18 in the Alerts & Notifications upload feature. A crafted CSV file will, when uploaded, trigger arbitrary JavaScript code execution.
- Product
- Redcap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comredcap.med.usc.edu
Sep 26, 2022Centreon v20.10.18 was discovered to contain a SQL injection vulnerability via the esc_name (Escalation Name) parameter at Configuration/Notifications/EscalatioCVE-2022-40043 · Other software · Centreon · reported by MITREHigh 8.8
Centreon v20.10.18 was discovered to contain a SQL injection vulnerability via the esc_name (Escalation Name) parameter at Configuration/Notifications/Escalations.
- Product
- Centreon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhakaioffensivesecurity.com
Sep 21, 2022Jenkins DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause, CVE-2022-41239 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability.
- Product
- Jenkins DotCi Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.