Updated 37 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

547new WordPress flaws this week

391,964entries in the database

4,746 results · page 60 of 95

Dec 20, 2023Export Import Menus: Unrestricted Upload of File with Dangerous TypeCVE-2023-34385 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Akshay Menariya Export Import Menus.This issue affects Export Import Menus: from n/a through 1.8.0.
Product
Export Import Menus
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update Export Import Menus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Popup Maker – Popup for opt-ins, lead gen, & more: Exposure of Sensitive Information to an Unauthorized ActorCVE-2022-47597 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Popup Maker Popup Maker – Popup for opt-ins, lead gen, & more.This issue affects Popup Maker – Popup for opt-ins, lead gen, & more: from n/a through 1.17.1.
Product
Popup Maker – Popup for opt-ins, lead gen, & more
Affected
up to 1.17.1
What to do
Affects up to 1.17.1. Update Popup Maker – Popup for opt-ins, lead gen, & more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Media File Renamer: Rename Files (Manual, Auto & AI): Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-44991 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Media File Renamer: Rename Files (Manual, Auto & AI).This issue affects Media File Renamer: Rename Files (Manual, Auto & AI): from n/a through 5.6.9.
Product
Media File Renamer: Rename Files (Manual, Auto & AI)
Affected
up to 5.6.9
What to do
Affects up to 5.6.9. Update Media File Renamer: Rename Files (Manual, Auto & AI) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Aruba HiSpeed Cache: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-44983 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Aruba.It Aruba HiSpeed Cache.This issue affects Aruba HiSpeed Cache: from n/a through 2.0.6.
Product
Aruba HiSpeed Cache
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Aruba HiSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023`EncryptingOutputStream` was susceptible to exposing uninitialized data.CVE-2023-6865 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
`EncryptingOutputStream` was susceptible to exposing uninitialized data. This issue could only be abused in order to write data to a local disk which may have implications for private browsing mode. This vulnerability affects Firefox ESR < 115.6 and Firefox < 121.
Product
Firefox ESR
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org lists.debian.org
Dec 18, 2023Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina): Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-44982 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina).This issue affects Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina): from n/a through 6.4.5.
Product
Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina)
Affected
up to 6.4.5
What to do
Affects up to 6.4.5. Update Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023E2Pdf – Export To Pdf Tool for: Deserialization of Untrusted DataCVE-2023-46154 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Deserialization of Untrusted Data vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress.This issue affects E2Pdf – Export To Pdf Tool for WordPress: from n/a through 1.20.18.
Product
E2Pdf – Export To Pdf Tool for
Affected
up to 1.20.18
What to do
Affects up to 1.20.18. Update E2Pdf – Export To Pdf Tool for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Swift Performance Lite: Does not prevent users from exporting the plugin's settingsCVE-2023-6289 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Swift Performance Lite WordPress plugin before 2.3.6.15 does not prevent users from exporting the plugin's settings, which may include sensitive information such as Cloudflare API tokens.
Product
Swift Performance Lite
Fixed in
2.3.6.15
What to do
Update Swift Performance Lite to 2.3.6.15 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 18, 2023Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro: Does not check nonce tokens early enough in the request lifecycleCVE-2023-5886 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers with the ability to upload files to make logged in users perform unwanted actions leading to PHAR deserialization, which may lead to remote code execution.
Product
Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro
Fixed in
1.4.0
What to do
Update Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro to 1.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 18, 2023Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro: Does not check nonce tokens early enough in the request lifecycleCVE-2023-5882 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution.
Product
Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro
Fixed in
1.4.0
What to do
Update Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro to 1.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 18, 2023Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro: Does not validate and sanitise the `wp_query` parameterCVE-2023-4724 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the `wp_query` parameter which allows an attacker to run arbitrary command on the remote server
Product
Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro
Fixed in
1.4.0
What to do
Update Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro to 1.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 15, 2023Due to improper error handling, a REST API resource could expose a server side error containing an internal WSO2 specific package name in the HTTP response.CVE-2023-6839 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Medium 5.3
Due to improper error handling, a REST API resource could expose a server side error containing an internal WSO2 specific package name in the HTTP response.
Product
WSO2 API Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.docs.wso2.com security.docs.wso2.com
Dec 13, 2023Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document.CVE-2023-45725 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.7
Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document. These design document functions are: * list * show * rewrite * update An attacker can leak the session component using an HTML-like output, insert the session as an external resource (such as an image), or store the credential in a _local document with an "update" function. For the attack to succeed the attacker has to be able to insert the design documents into the database, then manipulate a user to access a function from that design document. Workaround: Avoid using design documents from untrusted sources which may attempt to access or manipulate request object's headers
Product
Apache CouchDB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchdb.org lists.apache.org
Dec 7, 2023SENEC Storage Box V1,V2 and V3 accidentially expose a management UI accessible with publicly known admin credentials.CVE-2023-39171 · Other software · SENEC · reported by info@cert.vde.comHigh 7.2
SENEC Storage Box V1,V2 and V3 accidentially expose a management UI accessible with publicly known admin credentials.
Product
Storage Box V1
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Dec 7, 2023Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.CVE-2023-48841 · Websites & servers · Phpjabbers · reported by MITREHigh 8.8
Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.
Product
Appointment Scheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com phpjabbers.com
Dec 7, 2023Car Rental Script v3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.CVE-2023-48835 · Websites & servers · Phpjabbers · reported by MITREHigh 8.8
Car Rental Script v3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.
Product
CAR Rental Script
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com phpjabbers.com
Dec 7, 2023Shuttle Booking Software 2.0 is vulnerable to CSV Injection in the Languages section via an export.CVE-2023-48830 · Websites & servers · Phpjabbers · reported by MITREHigh 8.8
Shuttle Booking Software 2.0 is vulnerable to CSV Injection in the Languages section via an export.
Product
Shuttle Booking Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com phpjabbers.com
Dec 6, 2023In the module "Orders (CSV, Excel) Export PRO" (ordersexport) < 5.2.0 from MyPrestaModules for PrestaShop, a guest can download personal information without resCVE-2023-46354 · Other software · Myprestamodules · reported by MITREHigh 7.5
In the module "Orders (CSV, Excel) Export PRO" (ordersexport) < 5.2.0 from MyPrestaModules for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can access exports from the module which can lead to a leak of personal information from ps_customer/ps_address tables such as name / surname / email / phone number / full postal address.
Product
Orders (csv, Excel) Export Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.friendsofpresta.org security.friendsofpresta.org
Dec 6, 2023 Exposure of Proxy Administrator Credentials An authenticated administrator equivalent Filr user can access the credentials of proxy administrators.CVE-2023-32268 · Other software · OpenText · reported by security@opentext.comHigh 7.2
Exposure of Proxy Administrator Credentials An authenticated administrator equivalent Filr user can access the credentials of proxy administrators.
Product
Filr
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record portal.microfocus.com portal.microfocus.com
Dec 4, 2023Memory Corruption in SPS Application while exporting public key in sorter TA.CVE-2023-28546 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption in SPS Application while exporting public key in sorter TA.
Product
Snapdragon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Nov 30, 2023Premium Addons PRO: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-37868 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Leap13 Premium Addons PRO.This issue affects Premium Addons PRO: from n/a through 2.9.0.
Product
Premium Addons PRO
Affected
up to 2.9.0
What to do
Affects up to 2.9.0. Update Premium Addons PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Email download link: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-36523 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gopi Ramasamy Email download link.This issue affects Email download link: from n/a through 3.7.
Product
Email download link
Affected
up to 3.7
What to do
Affects up to 3.7. Update Email download link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023BookingPress – Appointment Booking Calendar Plugin and Online Scheduling: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-36507 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin.This issue affects BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin: from n/a through 1.0.64.
Product
BookingPress – Appointment Booking Calendar Plugin and Online Scheduling
Affected
up to 1.0.64
What to do
Affects up to 1.0.64. Update BookingPress – Appointment Booking Calendar Plugin and Online Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Zippy: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-26533 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gesundheit Bewegt GmbH Zippy.This issue affects Zippy: from n/a through 1.6.1.
Product
Zippy
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update Zippy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Libsyn Publisher Hub: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-25057 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Libsyn Libsyn Publisher Hub.This issue affects Libsyn Publisher Hub: from n/a through 1.3.2.
Product
Libsyn Publisher Hub
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Libsyn Publisher Hub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Booster for WooCommerce: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-48333 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pluggabl LLC Booster for WooCommerce.This issue affects Booster for WooCommerce: from n/a through 7.1.1.
Product
Booster for WooCommerce
Affected
up to 7.1.1
What to do
Affects up to 7.1.1. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Image Regenerate & Select Crop: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-46820 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Iulia Cazan Image Regenerate & Select Crop.This issue affects Image Regenerate & Select Crop: from n/a through 7.3.0.
Product
Image Regenerate & Select Crop
Affected
up to 7.3.0
What to do
Affects up to 7.3.0. Update Image Regenerate & Select Crop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Libsyn Publisher Hub: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-45834 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Libsyn Libsyn Publisher Hub.This issue affects Libsyn Publisher Hub: from n/a through 1.4.4.
Product
Libsyn Publisher Hub
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Libsyn Publisher Hub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Export All Posts, Products, Orders, Refunds & Users: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-45066 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1.
Product
Export All Posts, Products, Orders, Refunds & Users
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Export All Posts, Products, Orders, Refunds & Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-44150 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: from n/a through 4.13.2.
Product
Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.13.2
What to do
Affects up to 4.13.2. Update Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Email posts to subscribers: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-41735 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gopi Ramasamy Email posts to subscribers.This issue affects Email posts to subscribers: from n/a through 6.2.
Product
Email posts to subscribers
Affected
up to 6.2
What to do
Affects up to 6.2. Update Email posts to subscribers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Cookies and Content Security Policy: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-40662 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jonk @ Follow me Darling Cookies and Content Security Policy.This issue affects Cookies and Content Security Policy: from n/a through 2.15.
Product
Cookies and Content Security Policy
Affected
up to 2.15
What to do
Affects up to 2.15. Update Cookies and Content Security Policy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023EWWW Image Optimizer: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-40600 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Exactly WWW EWWW Image Optimizer. It works only when debug.log is turned on.This issue affects EWWW Image Optimizer: from n/a through 7.2.0.
Product
EWWW Image Optimizer
Affected
up to 7.2.0
What to do
Affects up to 7.2.0. Update EWWW Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Post Grid Combo – 36+ Gutenberg Blocks: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-40211 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid Combo – 36+ Gutenberg Blocks.This issue affects Post Grid Combo – 36+ Gutenberg Blocks: from n/a through 2.2.50.
Product
Post Grid Combo – 36+ Gutenberg Blocks
Affected
up to 2.2.50
What to do
Affects up to 2.2.50. Update Post Grid Combo – 36+ Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Product Stock Manager & Notifier for WooCommerce: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-37972 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in MultiVendorX Product Stock Manager & Notifier for WooCommerce.This issue affects Product Stock Manager & Notifier for WooCommerce: from n/a through 2.0.1.
Product
Product Stock Manager & Notifier for WooCommerce
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Product Stock Manager & Notifier for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Debug Log Manager: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-6136 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.0.
Product
Debug Log Manager
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Debug Log Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 29, 2023cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.CVE-2023-49083 · Other software · pyca · reported by GitHubMedium 5.9
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.
Product
cryptography
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 29, 2023The language file parsing process could be manipulated to expose environment variables.CVE-2023-40626 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 7.5
The language file parsing process could be manipulated to expose environment variables. Environment variables might contain sensible information.
Product
Joomla! CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Nov 28, 2023An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of serviceCVE-2023-42504 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.8
An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of service. This issue affects Apache Superset: before 3.0.0
Product
Apache Superset
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Nov 27, 2023In the module "Product Catalog (CSV, Excel) Export/Update" (updateproducts) < 3.8.5 from MyPrestaModules for PrestaShop, a guest can perform SQL injection.CVE-2023-46349 · Other software · Myprestamodules · reported by MITRECritical 9.8
In the module "Product Catalog (CSV, Excel) Export/Update" (updateproducts) < 3.8.5 from MyPrestaModules for PrestaShop, a guest can perform SQL injection. The method `productsUpdateModel::getExportIds()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
Product
Updateproducts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.friendsofpresta.org security.friendsofpresta.org
Nov 27, 2023An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to mistreatment of whitespace charactersCVE-2023-40194 · Other software · Foxit · reported by talos-cna@cisco.comHigh 8.8
An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to mistreatment of whitespace characters. A specially crafted malicious file can create files at arbitrary locations, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
Product
Foxit Reader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Nov 27, 2023An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to a failure to properly validate a dangCVE-2023-35985 · Other software · Foxit · reported by talos-cna@cisco.comHigh 8.8
An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to a failure to properly validate a dangerous extension. A specially crafted malicious file can create files at arbitrary locations, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted malicious site if the browser plugin extension is enabled.
Product
Foxit Reader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Nov 27, 2023Sensitive data exposure in Webconf in Tribe29 Checkmk Appliance before 1.6.8 allows local attacker to retrieve passwords via reading log files.CVE-2023-6287 · Other software · Checkmk GmbH · reported by security@checkmk.comLow 3.3
Sensitive data exposure in Webconf in Tribe29 Checkmk Appliance before 1.6.8 allows local attacker to retrieve passwords via reading log files.
Product
Checkmk Appliance
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record checkmk.com checkmk.com
Nov 27, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1.CVE-2023-49068 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not yet been released. In the mean time, we recommend you make sure the logs are only available to trusted operators.
Product
Apache DolphinScheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.apache.org
Nov 24, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.CVE-2023-48796 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable `MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus` to workaround this, or add the following section in the `application.yaml` file ``` management: endpoints: web: exposure: include: health,metrics,prometheus ``` This issue affects Apache DolphinScheduler: from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2, which fixes the issue.
Product
Apache DolphinScheduler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Nov 23, 2023 RVTools, Version 3.9.2 and above, contain a sensitive data exposure vulnerability in the password encryption utility (RVToolsPasswordEncryption.exe) and main aCVE-2023-44303 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
RVTools, Version 3.9.2 and above, contain a sensitive data exposure vulnerability in the password encryption utility (RVToolsPasswordEncryption.exe) and main application (RVTools.exe). A remote unauthenticated attacker with access to stored encrypted passwords from a users' system could potentially exploit this vulnerability, leading to the disclosure of encrypted passwords in clear text. This vulnerability is caused by an incomplete fix for CVE-2020-27688.
Product
RVTools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Nov 23, 2023Cloud Templates & Patterns collection: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-47529 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ThemeIsle Cloud Templates & Patterns collection.This issue affects Cloud Templates & Patterns collection: from n/a through 1.2.2.
Product
Cloud Templates & Patterns collection
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Cloud Templates & Patterns collection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 23, 2023Email Marketing for WooCommerce by Omnisend: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-47244 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Omnisend Email Marketing for WooCommerce by Omnisend.This issue affects Email Marketing for WooCommerce by Omnisend: from n/a through 1.13.8.
Product
Email Marketing for WooCommerce by Omnisend
Affected
up to 1.13.8
What to do
Affects up to 1.13.8. Update Email Marketing for WooCommerce by Omnisend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 23, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pandora FMS on all allows File Discovery.CVE-2023-41786 · Other software · Pandora FMS · reported by security@pandorafms.comMedium 6.8
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pandora FMS on all allows File Discovery. This vulnerability allows users with low privileges to download database backups. This issue affects Pandora FMS: from 700 through 772.
Product
Pandora FMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record https https
Nov 23, 2023An information exposure vulnerability has been found, the exploitation of which could allow a remote user to retrieve sensitive information stored on the serverCVE-2023-4595 · Other software · BVRP Software · reported by cve-coordination@incibe.esHigh 7.5
An information exposure vulnerability has been found, the exploitation of which could allow a remote user to retrieve sensitive information stored on the server such as credential files, configuration files, application files, etc., simply by appending any of the following parameters to the end of the URL: %00 %0a, %20, %2a, %a0, %aa, %c0 and %ca.
Product
SLmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es incibe.es

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.