Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,937 results · page 60 of 99
Dec 30, 2022Incorrect implementation in authentication protocol in M-Files Client before 22.5.11356.0 allows high privileged user to get other users tokens to another resouCVE-2022-4861 · Other software · M-Files · reported by security@m-files.comMedium 4.8
Incorrect implementation in authentication protocol in M-Files Client before 22.5.11356.0 allows high privileged user to get other users tokens to another resource.
- Product
- M-Files Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordempower.m-files.comproduct.m-files.com
Dec 30, 2022Insertion of Sensitive Information into Log Files in M-Files Server before 22.10.11846.0 could allow to obtain sensitive tokens from logs, if specific configuraCVE-2022-4858 · Other software · M-Files · reported by security@m-files.comMedium 4.4
Insertion of Sensitive Information into Log Files in M-Files Server before 22.10.11846.0 could allow to obtain sensitive tokens from logs, if specific configurations were set.
- Product
- M-Files Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordempower.m-files.comproduct.m-files.com
Dec 28, 2022Broken Link Checker: Does not sanitise and escape some of its settingsCVE-2022-3922 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Broken Link Checker WordPress plugin before 1.11.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Broken Link Checker
- Fixed in
- 1.11.20
- What to do
- Update Broken Link Checker to 1.11.20 or newer.
Dec 27, 2022The Noise protocol implementation suffers from weakened cryptographic security after encrypting 2^64 messages, and a potential denial of service attack.CVE-2021-4239 · Other software · github.com/flynn/noise · reported by security@golang.orgHigh 7.5
The Noise protocol implementation suffers from weakened cryptographic security after encrypting 2^64 messages, and a potential denial of service attack. After 2^64 (~18.4 quintillion) messages are encrypted with the Encrypt function, the nonce counter will wrap around, causing multiple messages to be encrypted with the same key and nonce. In a separate issue, the Decrypt function increments the nonce state even when it fails to decrypt a message. If an attacker can provide an invalid input to the Decrypt function, this will cause the nonce state to desynchronize between the peers, resulting in a failure to encrypt all subsequent messages.
- Product
- github.com/flynn/noise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be cCVE-2020-36564 · Other software · github.com/justinas/nosurf · reported by security@golang.orgHigh 7.5
Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be considered valid.
- Product
- github.com/justinas/nosurf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSCVE-2016-15005 · Other software · github.com/dinever/golf · reported by security@golang.orgHigh 8.8
CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSRF protections with relatively few requests.
- Product
- github.com/dinever/golf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Token validation methods are susceptible to a timing side-channel during HMAC comparison.CVE-2015-10004 · Other software · github.com/robbert229/jwt · reported by security@golang.orgHigh 7.5
Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC.
- Product
- github.com/robbert229/jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the user_id POST parameter before concatenating it to an SQL query in ajax-functions-backendCVE-2022-4156 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the user_id POST parameter before concatenating it to an SQL query in ajax-functions-backend.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 22, 2022Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification.CVE-2022-23539 · Other software · auth0 · reported by GitHubMedium 5.9
Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the `allowInvalidAsymmetricKeyTypes` option to `true` in the `sign()` and/or `verify()` functions.
- Product
- node-jsonwebtoken
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-freeCVE-2022-1097 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 22, 2022In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaCVE-2022-23540 · Other software · auth0 · reported by GitHubMedium 6.4
In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.
- Product
- node-jsonwebtoken
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022jsonwebtoken is an implementation of JSON Web Tokens.CVE-2022-23541 · Other software · auth0 · reported by GitHubMedium 5
jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `secretOrPublicKey` argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.
- Product
- node-jsonwebtoken
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session completely after client authentication faileCVE-2022-45347 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session completely after client authentication failed, which allowed an attacker to execute normal commands by constructing a special MySQL client. This vulnerability has been fixed in Apache ShardingSphere 5.3.0.
- Product
- Apache ShardingSphere-Proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Dec 16, 2022vRealize Operations (vROps) contains a broken access control vulnerability.CVE-2022-31708 · Other software · VMware · reported by security@vmware.comMedium 4.9
vRealize Operations (vROps) contains a broken access control vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 4.4.
- Product
- Vrealize Operations
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2022In authToken2AidlVec of KeyMintUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check.CVE-2022-20549 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In authToken2AidlVec of KeyMintUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-242702451
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 16, 2022In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administrator access token and flip or steal the mCVE-2022-36223 · Other software · Emby · reported by MITREMedium 6.1
In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administrator access token and flip or steal the media server administrator account.
- Product
- Emby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022VMware Workspace ONE Access and Identity Manager contain a broken authentication vulnerability.CVE-2022-31701 · Other software · VMware · reported by security@vmware.comMedium 5.3
VMware Workspace ONE Access and Identity Manager contain a broken authentication vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.3.
- Product
- Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner pCVE-2022-23741 · Other software · GitHub · reported by product-cna@github.comHigh 7.2
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner privileges. An attacker would require an account with admin access to install a malicious GitHub App. This vulnerability was fixed in versions 3.3.17, 3.4.12, 3.5.9, and 3.6.5. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- GitHub Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Dec 13, 2022Use of a Broken or Risky Cryptographic Algorithm in SICK RFU65x firmware version < v2.21 allows a low-privileged remote attacker to decrypt the encrypted data iCVE-2022-46834 · Other software · Sick · reported by psirt@sick.deMedium 6.5
Use of a Broken or Risky Cryptographic Algorithm in SICK RFU65x firmware version < v2.21 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites to be used for encryption via the SSH interface. The patch and installation procedure for the firmware update is available from the responsible SICK customer contact person.
- Product
- Rfu650-10100 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2022Use of a Broken or Risky Cryptographic Algorithm in SICK RFU63x firmware version < v2.21 allows a low-privileged remote attacker to decrypt the encrypted data iCVE-2022-46833 · Other software · Sick · reported by psirt@sick.deMedium 6.5
Use of a Broken or Risky Cryptographic Algorithm in SICK RFU63x firmware version < v2.21 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites to be used for encryption via the SSH interface. The patch and installation procedure for the firmware update is available from the responsible SICK customer contact person.
- Product
- Rfu630-04100 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2022Use of a Broken or Risky Cryptographic Algorithm in SICK RFU62x firmware version < 2.21 allows a low-privileged remote attacker to decrypt the encrypted data ifCVE-2022-46832 · Other software · Sick · reported by psirt@sick.deMedium 6.5
Use of a Broken or Risky Cryptographic Algorithm in SICK RFU62x firmware version < 2.21 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites to be used for encryption via the SSH interface. The patch and installation procedure for the firmware update is available from the responsible SICK customer contact person.
- Product
- Rfu620-10100 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2022If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively.CVE-2022-3996 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgHigh 7.5
If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy processing being enabled on a publicly facing server is not considered to be a common setup. Policy processing is enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. Update (31 March 2023): The description of the policy processing enablement was corrected based on CVE-2023-0466.
- Product
- OpenSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2022Use of a Broken or Risky Cryptographic Algorithm in SICK RFU61x firmware version <v2.25 allows a low-privileged remote attacker to decrypt the encrypted data ifCVE-2022-27581 · Other software · Sick · reported by psirt@sick.deMedium 6.5
Use of a Broken or Risky Cryptographic Algorithm in SICK RFU61x firmware version <v2.25 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites to be used for encryption via the SSH interface. The patch and installation procedure for the firmware update is available from the responsible SICK customer contact person.
- Product
- Rfu610-10600 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2022A stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) viCVE-2022-45690 · Other software · Stleary · reported by MITREHigh 7.5
A stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.
- Product
- Json-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2022Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport.CVE-2022-23505 · Other software · auth0 · reported by GitHubMedium 5.3
Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be able to bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession of an arbitrary IDP signed assertion. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. This issue is patched in version 4.6.3. Use of SAML2 authentication instead of WSFed is a workaround.
- Product
- passport-wsfed-saml2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2022Donation Button: Does not properly check for privileges and nonce tokens in its "donation_button_twilio_send_test_sms" AJAX actionCVE-2022-4004 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Donation Button WordPress plugin through 4.0.0 does not properly check for privileges and nonce tokens in its "donation_button_twilio_send_test_sms" AJAX action, which may allow any users with an account on the affected site, like subscribers, to use the plugin's Twilio integration to send SMSes to arbitrary phone numbers.
- Product
- Donation Button
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Donation Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2022In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them thrCVE-2022-46685 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them through the build log.
- Product
- Jenkins Gitea Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2022egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file.CVE-2022-45145 · Other software · Call-cc · reported by MITRECritical 9.8
egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file.
- Product
- Chicken
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.call-cc.orgcode.call-cc.org
Dec 9, 2022Akeneo PIM is an open source Product Information Management (PIM).CVE-2022-46157 · Other software · akeneo · reported by GitHubHigh 8.8
Akeneo PIM is an open source Product Information Management (PIM). Akeneo PIM Community Edition versions before v5.0.119 and v6.0.53 allows remote authenticated users to execute arbitrary PHP code on the server by uploading a crafted image. Akeneo PIM Community Edition after the versions aforementioned provides patched Apache HTTP server configuration file, for docker setup and in documentation sample, to fix this vulnerability. Community Edition users must change their Apache HTTP server configuration accordingly to be protected. The patch for Cloud Based Akeneo PIM Services customers has been applied since 30th October 2022. Users are advised to upgrade. Users unable to upgrade may Replace any reference to `<FilesMatch \.php$>` in their apache httpd configurations with: `<Location "/index.php">`.
- Product
- pim-community-dev
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2022Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack.CVE-2022-44938 · Other software · Seeddms · reported by MITRECritical 9.8
Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack.
- Product
- Seeddms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2022In JetBrains JetBrains Gateway before 2022.3 a client could connect without a valid token if the host consented.CVE-2022-46829 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.1
In JetBrains JetBrains Gateway before 2022.3 a client could connect without a valid token if the host consented.
- Product
- JetBrains Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Dec 8, 2022Tenda W6-S v1.0.0.4(510) was discovered to contain a stack overflow via the linkEn parameter at /goform/setAutoPing.CVE-2022-45503 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda W6-S v1.0.0.4(510) was discovered to contain a stack overflow via the linkEn parameter at /goform/setAutoPing.
- Product
- W6-s Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2022Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends.CVE-2022-46792 · Other software · Hasura · reported by MITREHigh 8.8
Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.12.1, 2.13.2, 2.14.1, and 2.15.2. (Versions before 2.10.0 are unaffected.)
- Product
- Graphql Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Dec 6, 2022RackN Digital Rebar through 4.6.14, 4.7 through 4.7.22, 4.8 through 4.8.5, 4.9 through 4.9.12, and 4.10 through 4.10.8 has exposed a privileged token via a publCVE-2022-46383 · Other software · Rackn · reported by MITRECritical 9.8
RackN Digital Rebar through 4.6.14, 4.7 through 4.7.22, 4.8 through 4.8.5, 4.9 through 4.9.12, and 4.10 through 4.10.8 has exposed a privileged token via a public API endpoint (Incorrect Access Control). The token can be used to escalate privileges within the Digital Rebar system and grant full administrative access.
- Product
- Digital Rebar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.rackn.iorackn.com
Dec 6, 2022The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv_backend_launch in cirCVE-2020-6627 · Other software · Seagate · reported by MITRECritical 9.8
The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv_backend_launch in cirrus/application/helpers/mv_backend_helper.php by leveraging the "start" state and sending a check_device_name request.
- Product
- Stcg2000300 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Dec 5, 2022All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens.CVE-2022-37783 · Other software · Craftcms · reported by MITREHigh 7.5
All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFT_CSRF_TOKEN and a HTML hidden field called CRAFT_CSRF_TOKEN to avoid Cross Site Request Forgery attacks. The CRAFT_CSRF_TOKEN cookie discloses the password hash in without encoding it whereas the corresponding HTML hidden field discloses the users' password hash in a masked manner, which can be decoded by using public functions of the YII framework.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comat-trustit.tuv.at
Dec 5, 2022Syncee: Leaks the administrator token that can be used to take over the administrator's accountCVE-2022-3694 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Syncee WordPress plugin before 1.0.10 leaks the administrator token that can be used to take over the administrator's account.
- Product
- Syncee
- Fixed in
- 1.0.10
- What to do
- Update Syncee to 1.0.10 or newer.
Nov 28, 2022The user_token authorization header on the Ourphoto App version 1.4.1 /apiv1/* end-points is not implemented properly.CVE-2022-24189 · Other software · Sz-fujia · reported by MITREMedium 6.5
The user_token authorization header on the Ourphoto App version 1.4.1 /apiv1/* end-points is not implemented properly. Removing the value causes all requests to succeed, bypassing authorization and session management. The impact of this vulnerability allows an attacker POST api calls with other users unique identifiers and enumerate information of all other end-users.
- Product
- Ourphoto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordscrawledsecurityblog.comscrawledsecurityblog.com
Nov 25, 2022user_oidc is an OpenID Connect user backend for Nextcloud.CVE-2022-39339 · Other software · nextcloud · reported by GitHubMedium 4.3
user_oidc is an OpenID Connect user backend for Nextcloud. In versions prior to 1.2.1 sensitive information such as the OIDC client credentials and tokens are sent in plain text of HTTP without TLS. Any malicious actor with access to monitor user traffic may have been able to compromise account security. This issue has been addressed in in user_oidc v1.2.1. Users are advised to upgrade. Users unable to upgrade may use https to access Nextcloud. Set an HTTPS discovery URL in the provider settings (in Nextcloud OIDC admin settings).
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2022user_oidc is an OpenID Connect user backend for Nextcloud.CVE-2022-39338 · Other software · nextcloud · reported by GitHubLow 3.5
user_oidc is an OpenID Connect user backend for Nextcloud. Versions prior to 1.2.1 did not properly validate discovery urls which may lead to a stored cross site scripting attack vector. The impact is limited due to the restrictive CSP that is applied on this endpoint. Additionally this vulnerability has only been shown to be exploitable in the Safari web browser. This issue has been addressed in version 1.2.1. Users are advised to upgrade. Users unable to upgrade should urge their users to avoid using the Safari web browser.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2022There is a broken access control vulnerability in the Maarch RM 2.8.3 solution.CVE-2022-37774 · Other software · Maarch · reported by MITREMedium 5.3
There is a broken access control vulnerability in the Maarch RM 2.8.3 solution. When accessing some specific document (pdf, email) from an archive, a preview is proposed by the application. This preview generates a URL including an md5 hash of the file accessed. The document's URL (https://{url}/tmp/{MD5 hash of the document}) is then accessible without authentication.
- Product
- Maarch RM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2022WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth: Broken Access ControlCVE-2022-41839 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Broken Access Control vulnerability in WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth. changing of Opt-In or Opt-Out tracking settings.
- Product
- WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 18, 2022Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.CVE-2022-42461 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.
- Affected
- up to 5.6.1
- What to do
- Affects up to 5.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 18, 2022Broken Access Control vulnerability in Permalink Manager Lite plugin <= 2.2.20 on WordPress.CVE-2022-41781 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Broken Access Control vulnerability in Permalink Manager Lite plugin <= 2.2.20 on WordPress.
- Affected
- up to 2.2.20
- What to do
- Affects up to 2.2.20. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 18, 2022WPML Multilingual CMS premium plugin <= 4.5.10 on: Broken Access ControlCVE-2022-38974 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with subscriber or higher user roles to change the status of the translation jobs.
- Product
- WPML Multilingual CMS premium plugin <= 4.5.10 on
- Affected
- up to 4.5.10
- What to do
- Affects up to 4.5.10. Update WPML Multilingual CMS premium plugin <= 4.5.10 on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 17, 2022WPML Multilingual CMS premium plugin <= 4.5.10 on: Broken Access ControlCVE-2022-38461 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with a subscriber or higher user role to change plugin settings (selected language for legacy widgets, the default behavior for media content).
- Product
- WPML Multilingual CMS premium plugin <= 4.5.10 on
- Affected
- up to 4.5.10
- What to do
- Affects up to 4.5.10. Update WPML Multilingual CMS premium plugin <= 4.5.10 on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 14, 2022 IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies.CVE-2022-34313 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. X-Force ID: 229449.
- Product
- CICS TX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Nov 14, 2022Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with a valid app token to retrieve other app CVE-2022-45183 · Other software · Ironmansoftware · reported by MITREHigh 8.8
Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with a valid app token to retrieve other app tokens by ID via an HTTP web request. Patched Versions are 3.5.3, 3.4.7, and 2.12.6.
- Product
- Powershell Universal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.ironmansoftware.comdocs.powershelluniversal.com
Nov 10, 2022Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.CVE-2022-41878 · Other software · parse-community · reported by GitHubHigh 7.2
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.2 or 4.10.19, keywords that are specified in the Parse Server option `requestKeywordDenylist` can be injected via Cloud Code Webhooks or Triggers. This will result in the keyword being saved to the database, bypassing the `requestKeywordDenylist` option. This issue is fixed in versions 4.10.19, and 5.3.2. If upgrade is not possible, the following Workarounds may be applied: Configure your firewall to only allow trusted servers to make request to the Parse Server Cloud Code Webhooks API, or block the API completely if you are not using the feature.
- Product
- parse-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2022Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress.CVE-2022-42460 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress.
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.